Trezor Hacked? Can Trezor Be Hacked, and How to Stay Safe

Worried your Trezor wallet has been hacked? In the overwhelming majority of “my Trezor got hacked” cases we see, the device itself was never touched: the crypto is still on the blockchain, and the loss, if there is one, came from a scam or a lost credential. The question “can a Trezor be hacked?” does have a more complicated answer than a flat no, though: a small number of documented lab attacks against older models are real, if narrow, and that distinction is what the rest of this page works through.

Can a Trezor Wallet Be Hacked?

No one has ever remotely hacked a Trezor over the internet to drain funds. Your private keys are generated and stored on the device and never leave it, so there’s no online “door” for an attacker to walk through from afar.

But “can a Trezor be hacked” is not the same question as “can a Trezor be hacked remotely.” With the physical device in hand, specialist equipment, and time, security researchers have extracted seeds from older Trezor models in a lab. That’s a very different threat from a hacker on the other side of the world, and understanding the difference is the whole point of this article.

So the accurate answer is: a Trezor is extremely secure against remote attacks, vulnerable to sophisticated physical attacks on older models if someone steals the device, and, like every wallet, only as safe as the human using it.

Has Trezor Ever Been Hacked? The Documented Cases

Yes, Trezor has been “hacked” in a laboratory sense, twice in well-known cases. Both required the physical device, and both are defeated by a passphrase.

The Kraken Security Labs voltage-glitch attack (2020)

In 2020, Kraken Security Labs demonstrated that a Trezor One or Trezor Model T could be opened up and, using a technique called voltage glitching, have its read protection downgraded so the encrypted seed could be dumped from the chip. They reported it took roughly 15 minutes of physical access. After extracting the encrypted data, a short PIN could then be brute-forced.

That physical-access requirement is exactly why a remote attacker can’t use it. Kraken’s own recommended fix was to enable a BIP39 passphrase, because the passphrase is never stored on the device and this attack cannot recover it. The weakness came from the general-purpose chip used, not from Trezor’s software.

The Unciphered physical hack (2023)

In 2023, the security firm Unciphered showed, in a video using a device supplied by CoinDesk, that they could extract the seed and PIN from a Trezor Model T they physically possessed. They used an unpatchable vulnerability in the STM32 chip, the same class of “RDP downgrade” weakness that had been flagged years earlier.

It only works with the device in the attacker’s physical possession, it can’t be patched on units already shipped because the flaw is in the chip itself, and Trezor noted that a strong passphrase renders the attack useless.

What these Trezor hacks do and don’t mean

If you own an older Trezor, keep it in your possession, and use a passphrase, these headline “Trezor hacked” stories are not a realistic threat to you: they describe expert teams with lab equipment and stolen hardware, not someone hacking your wallet while it sits in your drawer. Trezor’s newer Safe family (Safe 3, Safe 5, and Safe 7) added a dedicated EAL6+ secure element specifically to resist this type of physical attack.

The Real Way People Lose Crypto: Phishing and Scams

Almost every real-world loss involving a Trezor comes not from a cracked device, but from a person being tricked into giving away their seed phrase or approving a malicious transaction. The attackers don’t beat the hardware. They beat the human.

These campaigns often abuse Trezor’s brand and channels to look legitimate. In 2022, attackers used customer email addresses stolen from a third-party newsletter provider to send convincing fake Trezor emails. In 2025, criminals abused Trezor’s public support contact form so that automated replies came from the genuine help@trezor.io address, lending their phishing messages an air of authenticity. In both cases, Trezor’s own systems and the devices were not breached, and no seed was extracted through Trezor. The goal was simply to lure users to a fake site that asked them to type in their recovery seed.

No legitimate service, Trezor included, will ever ask you to enter your seed phrase on a website. If a page or email asks for it, it’s a scam.

How Trezor Actually Protects Your Crypto

It helps to know what stands between an attacker and your funds, because these layers are exactly why remote hacking isn’t realistic.

Your PIN protects access through the device, which erases its wallet data after too many incorrect attempts. This does not rule out specialist physical attacks on older models: in the research described above, short PINs were recovered after encrypted data had been extracted. If you forget your PIN, check your backup before considering a reset. Your passphrase, often called the 25th word, creates a hidden wallet that isn’t stored on the device at all, which is precisely why it defeats the physical attacks above. If you’ve lost your Trezor passphrase, that hidden wallet is the one holding your funds. On newer Safe models, an EAL6+ secure element adds hardware-level resistance to physical tampering, and Shamir Backup lets you split your seed into multiple shares so a single stolen copy isn’t enough.

Signs Your Trezor or Wallet May Be Compromised

Most “I’ve been hacked” scares turn out to be something harmless, like an empty hidden wallet or a derivation-path mismatch. Still, treat these as genuine red flags: transactions you did not authorize leaving your accounts, a passphrase or PIN that suddenly stops working when it always worked before, an email or site that asked you to enter your seed and you did, or a device that arrived with a pre-filled seed card or “activation” instructions (a classic supply-chain scam, since a real Trezor always generates your seed during your own setup).

If you only see an empty balance but never shared your seed, the cause is far more likely a missing passphrase or a wrong account type than a hack. Our guide on a lost or invalid Trezor seed phrase covers those cases.

What to Do If You Think Your Trezor Was Hacked

Act calmly and in order.

• If you still control a secure device and your seed, move your funds first. Set up a brand-new wallet on a device you trust, ideally with a fresh seed and a passphrase, and transfer everything to it immediately. Our Trezor wallet recovery guide walks through the restore process.
• Never enter your seed on any website, even one that looks like Trezor. Use only the device and official Trezor Suite.
• Stop interacting with the suspicious email, site, or “support agent.” Do not pay anyone promising to reverse a transaction.
• If your problem is lost access rather than theft (a forgotten PIN, a misplaced passphrase, or a damaged seed card), that is recoverable, and it’s exactly what we help with.

A confirmed blockchain transaction cannot be reversed. Police investigations and legal proceedings can sometimes lead to stolen assets being seized and returned, but that is separate from wallet access recovery and has no guaranteed outcome. Be wary of anyone promising guaranteed recovery. Crypto Recovers helps restore access to your own wallet; we do not recover stolen funds.

How Crypto Recovers Can Help

If you’ve lost access to your own Trezor (a forgotten PIN, a lost or partial seed, or a forgotten passphrase), that’s our specialty. The first assessment is free, we work on a success basis, and we never ask for your seed phrase upfront.

If you’re worried about a possible compromise and want a second opinion before you act, get in touch or start with our Trezor recovery service.

FAQ: Trezor Hacked

Can a Trezor be hacked remotely?

No. There is no documented case of a Trezor being hacked remotely to steal funds. Your private keys never leave the device, so there is no online path for a remote attacker. Remote losses come from phishing, not from breaking the device.

Has Trezor ever been hacked?

In a lab sense, yes. Kraken Security Labs (2020) and Unciphered (2023) both extracted seeds from Trezor devices they physically possessed, using a chip-level vulnerability on older models. Both attacks require the physical device and are defeated by a passphrase.

Can Trezor be hacked if someone steals the device?

On older models, a highly skilled attacker with lab equipment could extract the seed, which is why a passphrase matters so much: it isn’t stored on the device and blocks those attacks. Newer Trezor Safe models add a secure element that resists physical extraction.

Is a Trezor still safe to use?

Yes, for the vast majority of people a Trezor is very safe. The practical risk isn’t the hardware, it’s phishing. Use a passphrase, keep the device in your possession, and never enter your seed on any website.

Can a hacked Trezor’s stolen crypto be recovered?

A confirmed transaction cannot be reversed. In some cases, police investigations and legal proceedings can lead to stolen assets being returned, but this is never guaranteed. Crypto Recovers handles lost access to your own wallet, such as a forgotten PIN or passphrase; we do not recover stolen funds.