xmr.club
EN 中文 ES RU
★ FRONT-PAGECDexsport— Web3 crypto sportsbook + casino since 2021, No-KYC, accepts XMR (+38 coins). Read first: documented cancelled-winnings /→
/wallets · verified 2026-09-30

Trezor

B

Open-source-firmware hardware wallet with XMR support via Monero GUI + Feather. Grade B. Live incident: 2026-08-13 shipping-provider breach exposed 11,742 customers' full PII (name + phone + shipping address) to the black market — physical-safety risk, not phishing risk. Read the incident block before ordering.

Maintainer: SatoshiLabs (Trezor)

SatoshiLabs (Trezor) also runs: Trezor Suite A

⚠ INCIDENT

Incident timeline

  1. 2026-08-20auto Trezor published an official 2026-08-13 blog naming ShipMonk as the breached fulfillment partner and restating 11,742 full-address records plus 1,947 partial; devices and firmware remain unaffected. After the first post, Trezor said the 1,947 partial cohort (name/city/email only) may include older-than-90-day orders…
  2. 2026-09-07 Trezor disclosed that ShipMonk had kept records it was required to delete; about 67,000 additional US customers affected, bringing the total to roughly 81,000. Data exposed: names, shipping addresses, emails, phone numbers. Devices and firmware unaffected.
  3. 2026-09-11 Separate breach at Brevo, Trezor's newsletter provider: about 347,000 subscribers received a phishing email titled "Critical Security Alert: STM32 Entropy Vulnerability"; about 2,500 clicked before the malicious site was taken offline roughly 20 minutes after detection.
light kyc HARDWAREOPEN-SOURCE FW non custodialopen sourcexmr native
Visit Trezor → ⚠ Report Markdown twin Share ↗

At a glance

Grade
B
KYC posture
light kyc
Fees
Hardware device $69+ · Network fees only
Last verified
2026-09-30
Operating since
2014 · 12y — operating_since estimated from about-page heuristic; WHOIS and archive.org both returned no signal
Incident
⚠ Active since 2026-08-13 — /incidents
B Why grade B?

Solid pick. Verified working but with a meaningful caveat (UX rough, smaller market, intermediate trust step, partial coverage). Listed because the trade-off is sometimes worth it.

Full rubric + 7-step verification walkthrough at /methodology.

curator verdict · bottom line

Curator Verdict & OpSec Breakdown

THE BOTTOM LINE

Trezor is a verified, functional Monero wallet that performs solidly for day-to-day use, provided readers account for its specific operational trade-offs.

✓

Proven Strengths

  • ▸ Non-custodial architecture: user retains full custody of private keys throughout execution.
  • ▸ Open-source codebase: public code repositories allow independent verification and audit.
  • ▸ Established operational track record: serving users continuously since 2014 (12 years).
⚠

OpSec Trade-offs & Caveats

  • ▸ ACTIVE INCIDENT (2026-08-13): A third-party shipping provider used by Trezor (ShipMonk) was breached, exposing full names, phone numbers, email addresses and shipping addresses. Trezor's first count (2026-08-13) was 11,742 customers with full exposure plus 1,947 partial; on 2026-09-07 it disclosed that ShipMonk had failed to delete older records as required, adding about 67,000 US customers and bringing the total to roughly 81,000. Separately, attackers compromised Brevo, the service Trezor uses for newsletters, and on 2026-09-11 sent about 347,000 Trezor subscribers a fake "Critical Security Alert: STM32 Entropy Vulnerability" email; about 2,500 people clicked before the phishing site was taken down roughly 20 minutes later. Trezor firmware and devices are not affected: both incidents sit in Trezor's vendors, not its hardware. The risk to readers is twofold: convincing phishing that now knows you own a Trezor, and home addresses of confirmed crypto holders circulating, which is a physical-safety problem, not just an inbox one.
  • ▸ Heuristic KYC triggers: transactions or accounts may be frozen for ID review if flagged by automated risk rules.
  • ▸ Clearnet-only footprint: lacks an official .onion hidden service mirror; exposes visitor network IP unless routed through VPN/Tor.

Review

Live incident (2026-08-13). A Trezor shipping-provider breach exposed the full PII (name + phone + email + shipping address) of 11,742 customers who ordered in the 90 days prior to 2026-08-08 (plus 1,947 with partial exposure). Countries: US, UK, Sweden, Colombia, Brazil, Italy, Portugal. Trezor's public framing leads with *"our devices remain secure"* — technically true and completely beside the point. The reader-facing risk is not phishing; it is physical: confirmed crypto-holder home addresses in the hands of any buyer of the leaked data is home-invasion / stalking / $5-wrench-attack territory. Trezor firmware and devices are unaffected. See `/guides/old-iphone-cold-storage` for the shipping-address-opsec reframe + a step-by-step alternative that closes this class of exposure.

What Trezor is. Open-source-firmware hardware wallet family (Trezor One, Model T, Safe 3, Safe 5). Native Monero support via Monero GUI and Feather; the wallet holds the key, the host builds the tx, the device signs. Vendor: SatoshiLabs (Czech Republic), 12+ years of continuous operation.

Grade B rationale. The wallets themselves work well and are among the most transparent hardware in the space (fully open-source firmware, bootloader, and schematics). The B (rather than higher) reflects the recurring supply-chain and vendor-side exposure history — the 2026-08 shipping breach is the third significant PII-adjacent incident affecting Trezor customers this cycle, on top of long-standing concerns about the Trezor Suite auto-update posture. Not a firmware trust issue; a vendor-relationship + shipping-address surface issue.

What you trust. Firmware openness, well-audited cryptography, community-maintained fork ecosystem (Trezor firmware is the reference for several third-party hardware wallets), Monero GUI + Feather integration that Just Works.

What you don't. SatoshiLabs's fulfillment supply chain. Ordering to a legal-name shipping address puts you on any future breach-victim list. Mitigations: PO box, drop shipper, mail-forwarding service, or the separate-iPhone pattern in the linked guide.

Alternatives. For the airgap use case specifically: Cupcake Wallet (by the Cake Wallet team) on an old iPhone / Android — purpose-built for exactly the airgap-signer role, avoids the shipping-address surface entirely. For a hardware wallet without changing the pattern: rotate through a shipping-privacy layer before your next order.

Cross-refs. Parent guide: `/guides/monero-cold-storage`. Alternative pattern: `/guides/old-iphone-cold-storage`. Verify-your-binary: `/guides/verify-wallet-binary`.

Fees

Hardware device $69+ · Network fees only

Links

Sourced from operator pages — verify identity via more than one channel before trusting time-sensitive instructions.

Audit trail — receipts for the editorial claim

  • ● UPSTREAM Up · HTTP 200 · 84ms · checked 12h ago
  • ○ ONION No .onion mirror listed
  • ✎ MANUAL Last manual verification 2026-09-30 (<30d)
  • ⌕ LOG See curator log for Trezor

Reviews — moderated · rules

No community reviews yet. Be the first below.

Add a review

Honest, brand-neutral feedback welcome. A curator approves before it appears here. No JS required.

Keep order IDs, txids and addresses out of the review text: anything ID-like there is hidden when published.

Required: review body. Honest, descriptive reviews get approved within a day. Marketing copy, slurs, or invective get rejected. Per-day cap of 5 submissions per IP.