If this was another company and any other secure chip, you would not have heard much. Instead of hiding behind NDAs and closed-source code, we choose a different path.
No hardware is flawless, but closed chips hide their flaws. We chose Tropic Square because its open architecture means vulnerabilities can actually be found, discussed freely, and fixed. That is how technology truly hardens over time.
I know hearing about a vulnerability can cause some worry, but your funds on the Safe 7 are fully secure. Our multi-layered defense stands firm, ensuring your keys remain safe even against this kind of highly sophisticated, physical attack.
Short-term pain, long-term gain. That’s how it goes with open source and radical transparency.
Transparency is non-negotiable.
Tropic Square disclosed a vulnerability in the TROPIC01 Secure Element chip used in Trezor Safe 7. It has been identified based on findings from the Ledger Donjon team's independent audit.
Important: Your funds remain safe and secure. Trezor Safe 7 has not been hacked, and you don’t need to take any action.
What you need to know:
- This discovery cannot give an attacker access to your PIN, funds, or wallet backup in Trezor Safe 7. The vulnerability concerns only the TROPIC01 Secure Element chip, one of three physical, independent security layers, not the whole device.
We’re releasing this news proactively because this is how open-source security should work. Transparency is non-negotiable. Collaborations like this raise the bar for the entire industry and make self-custody security stronger for everyone.
Here is our response to the findings:
trezor.io/blog/news/Trezor-r…