Hardware wallets have long been considered the gold standard of cryptocurrency security — a physical fortress separating private keys from the internet’s constant barrage of attacks. But a vulnerability disclosure in mid-March 2025 shook that assumption when Ledger Donjon, the open-source security research arm of rival wallet manufacturer Ledger, revealed critical flaws in Trezor’s Safe 3 and Safe 5 hardware wallet models. With Bitcoin trading at approximately $83,900 and Ethereum around $1,900 at the time, the stakes of hardware wallet security have never been higher. This incident offers a comprehensive case study in cold storage threat modeling and best practices for every crypto holder.
The Threat Landscape
The Trezor Safe vulnerability centered on the TRZ32F429 microcontroller — a customized variant of the STM32F429 chip used in both the Safe 3 and Safe 5 models. Ledger Donjon demonstrated that this microcontroller remains vulnerable to voltage glitching attacks, a sophisticated physical technique that involves applying precise voltage fluctuations to a chip during operation. By desoldering the microcontroller and carefully manipulating the power supply, an attacker can cause the chip to skip security checks and reveal the contents of its flash memory.
What makes this particularly concerning is the authentication architecture Trezor employs. The devices use a pre-shared secret stored between the Secure Element and the microcontroller to verify that the firmware has not been tampered with. If an attacker can extract this secret through a glitching attack, they could theoretically reprogram the device with malicious firmware while making it appear genuine to the user. Trezor had implemented a firmware integrity check designed to detect modified software, but Ledger demonstrated that this security check could be bypassed using the voltage glitching technique.
The most alarming attack vector identified was supply chain compromise. A sophisticated actor with physical access during manufacturing or distribution could implant malicious firmware that would be virtually undetectable by the end user. This type of attack does not require any interaction with the victim — the compromised device could silently exfiltrate private keys the moment it is initialized.
Core Principles
The Trezor incident reinforces several fundamental principles of hardware wallet security that every cryptocurrency holder should internalize. First, no security solution is absolute. Hardware wallets significantly raise the bar for attackers, but they are not impervious to sophisticated physical or supply chain attacks. The defense-in-depth model — layering multiple security measures so that the failure of any single measure does not result in total compromise — remains the most robust approach.
Second, the security of a hardware wallet depends not just on its hardware and firmware, but on its entire supply chain. Where and how a device is manufactured, shipped, stored, and sold all affect its security posture. A tamper-evident package that arrives intact means very little if the device was compromised before it was sealed at the factory.
Third, the passphrase feature represents one of the most powerful — and underutilized — security mechanisms available to hardware wallet users. Even if an attacker extracts the seed phrase from a compromised device, the passphrase (sometimes called the 25th word) prevents access to the actual funds without it. This creates a second factor that exists only in the user’s memory.
Tooling and Setup
For users evaluating hardware wallet options, several practical tools and configurations can significantly enhance security. When setting up any hardware wallet, always generate a new seed phrase on the device itself — never import a seed that was created or displayed on a computer or phone. Enable the passphrase feature and choose a strong, memorable passphrase that is not derived from personal information. Store the seed phrase in a secure, offline location, ideally using a metal backup solution that can survive fire, water, and physical damage.
For Trezor users specifically, the Safe 5 model features an upgraded microcontroller that is resistant to the voltage glitching technique demonstrated by Ledger Donjon. Users of the Safe 3 should ensure their firmware is fully updated through the official Trezor Suite application. Regularly checking for firmware updates and applying them promptly is one of the simplest yet most effective security practices available.
When purchasing any hardware wallet, buy exclusively from the manufacturer’s official website or authorized resellers. Avoid second-hand devices, marketplace purchases, or any device that shows signs of tampering with its packaging. The few dollars saved on a discounted device pale in comparison to the potential loss of your entire cryptocurrency portfolio.
Ongoing Vigilance
Hardware wallet security is not a one-time setup — it requires ongoing attention. Periodically verify your device’s firmware through the official companion software. Monitor the manufacturer’s security announcements and apply updates as they become available. If you notice any unexpected behavior from your device — transactions you did not authorize, addresses that do not match, or connectivity issues — treat it as a potential compromise until proven otherwise.
Consider distributing your holdings across multiple hardware wallets from different manufacturers. This diversification strategy limits the impact of any single vendor’s vulnerability. If one wallet’s security is compromised, your exposure is limited to the funds stored on that specific device.
The broader lesson from the Trezor vulnerability is that the cryptocurrency security ecosystem benefits from transparent, responsible disclosure. Ledger’s research and Trezor’s subsequent patch demonstrate how competition and cooperation between security-focused companies can ultimately strengthen the entire industry. Users should demand this level of transparency from every hardware wallet manufacturer.
Final Takeaway
Hardware wallets remain one of the most effective tools for protecting cryptocurrency assets, but they are not magical invulnerability shields. The Trezor Safe vulnerability is a reminder that security is a continuous process, not a product you purchase. By understanding the threat model, following best practices for purchase and setup, and maintaining ongoing vigilance, you can significantly reduce your risk profile. In a market where Bitcoin hovers near $84,000 and total crypto market capitalization exceeds $2.7 trillion, the few minutes spent on proper security hygiene could be the most valuable investment you ever make.
Disclaimer: This article is for educational purposes only and does not constitute financial advice. Always conduct your own research before making security decisions for your cryptocurrency holdings.
Ledger Donjon desoldering the TRZ32F429 to voltage glitch it is a sophisticated physical attack. most people worry about remote exploits but if someone has your Safe 5 and a soldering iron youre cooked
exactly, and at $83,900 per BTC the ROI on a physical attack suddenly makes sense. this isnt theoretical anymore
solder_monkey_ desoldering the TRZ32F429 and voltage glitching it is not something your average attacker does in a coffee shop. if someone has your wallet in their lab with soldering equipment your threat model failed way before the glitch
seed phrase stored separate kills that attack vector on safe 3 and 5
desoldering the microcontroller to voltage glitch it requires physical access and specialized lab equipment. this is a nation-state threat model not a coffee shop attack vector
glitch_test_ desoldering plus voltage glitching plus lab equipment equals nation state threat model. no one is doing this to steal your $4k bag at a coffee shop
of course ledger security team found this. convenient timing to make the competitor look bad right before their next product launch
ledger finding trezor bugs is ironic given ledger recover. both companies have trust issues, just different flavors
ledger recovering your seed with their custodian and ledger finding trezor bugs. pick your poison i guess
Petra V. the irony goes deeper than you think. ledger recover stores your seed phrase on their servers by design. trezor has a physical vulnerability that requires lab equipment and a PhD. one is a conscious choice that undermines self custody, the other is a hardware limitation
Voltage glitching requires physical access and desoldering – this isn’t a threat for normal users.
Voltage glitching requires physical access and desoldering. If someone has your hardware wallet in their lab, you have bigger problems than the firmware.
desoldering is the key word here. if you store your seed phrase separately and the device gets stolen, attacker gets nothing. physical access alone isnt enough without the pin
storing the seed phrase separately defeats the whole attack vector described here. physical access without the seed is just expensive e-waste
voltage glitching the TRZ32F429 requires desoldering and lab equipment. if someone has your wallet in their lab your seed phrase location is the real defense
Storing seed separately defeats this attack vector completely. Physical access without keys = useless.
exactly. the threat model here is targeted physical attack, not remote. your keys are still safer on a trezor than on any exchange
voltage glitching requires physical desoldering. if your seed phrase is stored separately, this attack is basically useless
ledger finding trezor bugs before their own product launch feels like the new apple vs samsung playbook
Ledger finding Trezor bugs conveniently before their product launch feels very calculated.
ledger donjon publishing trezor flaws right before their own product push is textbook corporate espionage dressed as responsible disclosure
ledger donjon dropping trezor safe voltage glitching right before their own push
desolder_gang calling it corporate espionage is a stretch. Ledger Donjon has been publishing Trezor research for years as an open source security team. the timing with product launches is convenient sure but responsible disclosure has its own schedule
threat model here is targeted physical attacks against high-value targets. for 99% of users, hardware wallets are still way safer than exchange custody
the irony of Ledger Donjon publishing this while Ledger Recover exists. both companies have trust issues just different flavors of compromise
Iben S. ledger criticizing trezor while selling a key recovery service that literally transmits your seed phrase in encrypted shards. both companies have unresolvable trust deficits
Ledger Donjon publishing Trezor flaws while selling Ledger Recover which transmits your seed in encrypted shards. both companies have trust issues in completely opposite directions