Trezor Safe 5:
the same open-source firmware as the flagship, minus the chip that got cracked in a lab.
We tore apart Trezor's mid-range touchscreen hardware wallet across seven weighted categories; from a real, distinctive MAC&Destroy PIN mechanism and Trezor's own explicit confirmation that a newer microcontroller shields the Safe 5 from a voltage-glitch attack demonstrated against its cheaper sibling, to real signing-outside-the-secure-element architecture and a genuinely unresolved price discrepancy across sources; and landed on a score the marketing page won't show you.
Our take, up front: the Safe 5 shares the same real advantage as its pricier sibling: every line of firmware, including the code running on the secure element, is published on GitHub and independently auditable, a genuine, structural transparency closed-source competitors can't match. It pairs that with a real, distinctive PIN mechanism (MAC&Destroy, where each wrong attempt physically destroys a one-time slot inside the chip, limiting brute-force attempts in hardware, not just software) and Trezor's own explicit confirmation that the Safe 5 sidesteps a voltage-glitch attack Ledger's own security lab, Donjon, demonstrated against the cheaper Safe 3, because it uses a newer, more resilient microcontroller. The honest nuance: at least one detailed source notes the Safe 5 shares the Safe 3's basic architecture, signing outside the secure element itself, rather than the Safe 7's more thorough dual-chip design where both elements must agree. Add a real, unresolved discrepancy in the price itself, some sources cite $129, others $169, even among 2026 reviews, and this is a genuinely strong, honestly-priced-somewhere wallet whose full picture depends on reading past the headline. We weighted all of it below.
The Safe 5 uses a certified, NDA-free EAL6+ secure element, the same certification class used in passports, banking cards, and SIM cards, and every line of firmware, including the code running on the secure element itself, is published on GitHub and independently auditable by anyone. PIN protection uses a real, distinctive MAC&Destroy mechanism: each incorrect PIN attempt permanently destroys a one-time physical slot inside the chip, meaning brute-force attacks are limited in hardware, not just by software. Trezor's own vulnerability disclosure page states plainly that the Safe 5 is not affected by a voltage-glitch attack Ledger Donjon, the same security lab behind the Safe 7's TROPIC01 finding, demonstrated against the cheaper Safe 3, because the Safe 5 uses a newer STM32U5 microcontroller specifically designed to resist that class of attack. The honest nuance: at least one detailed source notes the Safe 5 shares the Safe 3's basic architectural shape, signing occurs outside the secure element itself, rather than the Safe 7's dual-chip design where both elements must independently agree. A passphrase entered on the touchscreen, never stored on the device, defeats seed-extraction scenarios outright on any hardware wallet.
Pros
- Fully open-source firmware, including secure-element code, published on GitHub for independent audit
- MAC&Destroy PIN mechanism physically, not just logically, limits brute-force attempts
- Explicitly and specifically confirmed by Trezor as unaffected by the Donjon-demonstrated Safe 3 vulnerability
Cons
- Signing occurs outside the secure element, the same architectural shape as the cheaper Safe 3
- Lacks the Safe 7's dual-chip design requiring two independent secure elements to agree
The Universal firmware supports 8,000-plus coins and tokens, covering Bitcoin, Ethereum, Litecoin, Cardano, BNB, XRP, Dogecoin, Polygon, and ERC-20 tokens including USDT, USDC, and DAI. NFTs on Ethereum and EVM chains are supported through integrations, and the device works with Trezor Suite as well as third-party apps including MetaMask, Exodus, and Electrum. A separate Bitcoin-only firmware option exists for users who specifically want a narrower, single-asset device, priced the same as the universal version.
Pros
- 8,000-plus supported coins and tokens through Universal firmware
- Real compatibility with third-party wallets (MetaMask, Exodus, Electrum)
- Bitcoin-only firmware option available at the same price
Cons
- None significant found in our research
A 1.54" color touchscreen with haptic feedback and a Gorilla Glass surface handles setup, PIN entry, and transaction verification. Setup is described as straightforward across multiple sources; the device ships without pre-installed firmware for security reasons and verifies its own authenticity during the install process. There's no Bluetooth or wireless charging, a deliberate design choice that trades convenience for a smaller attack surface rather than an oversight.
Pros
- Color touchscreen with haptic feedback, genuinely easier than button-based navigation
- Ships without pre-installed firmware and self-verifies authenticity during setup
Cons
- Smaller screen (1.54") than the Safe 7's 2.5" display
- No Bluetooth or wireless charging, a deliberate trade-off some users will feel as a limitation
Gorilla Glass protects the touchscreen, and the device is available in three finishes (Black Graphite, Violet Ore, Green Beryl), a real, if minor, personalization option. The Safe 5 uses a standard plastic build rather than the Safe 7's aluminum unibody, and it lacks the IP67 waterproofing found on the pricier model.
Pros
- Gorilla Glass display protection
- Three color finishes offer a real, if minor, personalization option
Cons
- Standard plastic build, not the Safe 7's aluminum unibody
- No IP67 waterproofing
Trezor is built by SatoshiLabs, the same long-established Czech company behind the Safe 7, and launched the Safe 5 in July 2024. Trezor's own vulnerability disclosure page directly and specifically addresses the Safe 5's non-exposure to the Donjon-demonstrated Safe 3 flaw, a real, concrete example of proactive, specific security communication rather than a vague reassurance. Our research turned up no comparable pattern of customer data breaches.
Pros
- Long, established operating history as one of the original hardware wallet makers
- Specific, transparent vulnerability disclosure directly addressing the Safe 5's non-exposure to a known, named flaw
Cons
- None significant found in our research
This is a real, unresolved discrepancy worth stating plainly: some sources, including detailed 2026 technical reviews, cite $129 as the current price; others, including sources also dated 2026, cite $169 as the standing list price, with sale pricing occasionally appearing around $135. There's no subscription fee either way; the device price is the entire cost of ownership. One detailed reviewer's own candid take: "if the price drops closer to $120-140, I think it will be a better deal." A separate, more technical review calls the Safe 5 "the best value point in the Trezor lineup" specifically at the lower price point, since it delivers the same open-source firmware as the Safe 7 for meaningfully less.
Pros
- No subscription fee; the device price is the entire cost of ownership
- At the lower cited price, genuinely strong value against the Safe 7's open-source firmware for less money
Cons
- Real, unresolved price discrepancy across sources ($129 vs. $169), even among similarly-dated 2026 reviews
Shamir Backup (SLIP39) offers genuinely advanced, split-based recovery beyond a single seed phrase. Standard passphrase wallets, coin control, Tor support, and microSD encryption round out a real, feature-dense package for this price tier, matching much of what the pricier Safe 7 offers minus the wireless-specific extras.
Pros
- Shamir Backup (SLIP39) for advanced, split-based recovery
- Tor support and microSD encryption, genuinely uncommon extras at this price point
Cons
- Lacks the Safe 7's quantum-ready firmware and wireless-specific extras
Buy only through Trezor's official store, and confirm the current price first.
Buying direct is the only way to be confident your device hasn't been tampered with. Given the real, unresolved discrepancy between $129 and $169 across sources, check Trezor's own site for the current, exact price before deciding.
Most of the Safe 7's real trust advantage, without its most expensive extras.
The Safe 5 carries forward the genuine, structural strength that makes Trezor's whole lineup worth taking seriously: fully open-source, independently auditable firmware, backed here by a real, hardware-enforced PIN mechanism and Trezor's own specific, transparent confirmation that it isn't exposed to a competitor-demonstrated flaw in its cheaper sibling. What it doesn't carry forward is the Safe 7's more thorough dual-chip architecture, since signing here happens outside the secure element, and its premium build. Layer on a real, unresolved discrepancy in the price itself across otherwise credible 2026 sources, and this is a genuinely strong wallet whose exact value proposition depends on confirming a number we couldn't fully settle ourselves.
The scorecard above is deliberately general. Whether the Trezor Safe 5 is right for you depends heavily on which of these you already are.
The first-time self-custody buyer who wants open-source security without the premium price
You want independently auditable firmware and a real touchscreen, but don't need Bluetooth, wireless charging, or the Safe 7's dual-chip architecture.
The long-term holder who checks balances occasionally, not daily
You connect your wallet once in a while to move a position; the Safe 5 gives you everything you need without wireless features sitting unused.
The budget-conscious buyer willing to wait for a better price
Given the real, unresolved discrepancy between $129 and $169 across sources, it's worth checking Trezor's own site directly and watching for the lower figure or a sale.
Anyone who specifically wants the Safe 7's dual-SE architecture or premium build
Signing happens outside the secure element here, and the build is standard plastic rather than aluminum with IP67 waterproofing; the Safe 7 is the right pick if those specifics matter to you.
The scorecard covers the headline judgment calls. These four tables cover the specifics we didn't want to bury in prose; the Safe 3 vulnerability and why the Safe 5 isn't affected, how open-source coverage actually differs across Trezor's own lineup, the full Safe 3/5/7 family ladder, and how the Safe 5 compares against the other hardware wallets we've reviewed.
The Safe 3 vulnerability, and why the Safe 5 isn't affected
| Detail | |
|---|---|
| Who found it | Ledger Donjon, the same security lab behind the separate Safe 7 TROPIC01 finding |
| Attack type | Voltage-glitch attack |
| Affected device | Trezor Safe 3 |
| Trezor's own statement | "Trezor Safe 5 is not affected because it uses a more recent microcontroller designed to be more resilient to similar attacks" |
| Why | Safe 5 uses the newer STM32U5 microcontroller instead of the Safe 3's older chip |
| Requirements to replicate | Physical possession plus specialist equipment; funds never at remote risk |
A passphrase entered on the touchscreen, never stored on the device, defeats seed-extraction scenarios outright on any hardware wallet, an extra layer of protection worth using regardless of which Trezor model you own.
Open-source coverage: Safe 5 vs. Safe 7
| Safe 5 | Safe 7 | |
|---|---|---|
| Firmware code | Fully open, published on GitHub | Fully open, published on GitHub |
| Secure element chip design | EAL6+, firmware auditable but chip itself not open-source | TROPIC01: full hardware design, firmware, and spec published |
| Signing location | Outside the secure element | Requires agreement between both secure elements |
Both devices are genuinely open-source at the firmware level; the real difference is how much of the underlying chip architecture itself is auditable, and the Safe 7 goes meaningfully further here.
The Trezor family ladder: Safe 3, Safe 5, Safe 7
| Safe 3 | Safe 5 | Safe 7 | |
|---|---|---|---|
| Price | $59-$79 | $129 (some sources: $169) | $249 |
| Secure element | EAL6+ (older microcontroller) | EAL6+ (STM32U5) | Dual: TROPIC01 + EAL6+ |
| Screen | Monochrome | 1.54" color touchscreen, haptic | 2.5" OLED touchscreen |
| Wireless | None | None | Bluetooth (kill switch) + Qi2 |
| Body material | Plastic | Plastic | Aluminum, IP67 |
The Safe 5's real value proposition sits in the middle: a genuine touchscreen and the STM32U5 upgrade over the Safe 3, without paying for the Safe 7's wireless and premium-build extras.
How it compares to other hardware wallets we've reviewed
| Wallet | Firmware | Secure element | Price | Notable trade-off |
|---|---|---|---|---|
| Trezor Safe 5 | Open-source | Single EAL6+ (STM32U5) | $129-$169 (sources vary) | Signs outside the SE; no wireless features |
| Trezor Safe 7 | Open-source | Dual: TROPIC01 (auditable) + EAL6+ | $249 | Disclosed lab-conditions TROPIC01 vulnerability |
| Ledger Flex | Closed-source | CC EAL6+ (ST33K1M5) | $249 | Recover controversy, two customer data breaches |
At $129, the Safe 5 undercuts Ledger's closed-source Flex on price while offering fully open, independently auditable firmware, a genuine, structural advantage regardless of which specific price figure turns out to be current.
We don't just want to hand you our number; we want to show you how it sits next to what other review desks and comparison sites have published. This includes a real, cited numeric score from one of our sources, marked accordingly below. Coverage ranges from strongly enthusiastic about the value proposition to genuinely candid about whether the price justifies the upgrade over the Safe 3.
Our score lands modestly below the aggregated industry average; several sources lead with the genuine open-source and value-for-money story without weighting the real architectural gap versus the Safe 7 (signing outside the secure element) or the unresolved price discrepancy as heavily as we do.
| Source | Score | Type |
|---|
Scores compiled by our editorial team from publicly available reviews as of August 2026. "Editorial estimate" means the outlet didn't publish a single numeric score, so we converted their published verdict and sentiment into a comparable 100-point figure. Verify current figures directly with each source before citing them elsewhere.
Sources genuinely disagree, even among detailed 2026 reviews. Some cite $129 as the current list price, others cite $169, with occasional sale pricing around $135. We couldn't resolve this discrepancy definitively, so confirm the current price directly on Trezor's own site before buying.
No. Trezor's own vulnerability disclosure page explicitly states the Safe 5 is not affected, because it uses a newer STM32U5 microcontroller specifically designed to resist the voltage-glitch attack Ledger Donjon demonstrated against the Safe 3.
It means the microcontroller, not the certified secure element chip, handles the actual transaction signing process, the same basic architecture as the cheaper Safe 3. The Safe 7's dual-chip design goes further, requiring both its secure elements to independently agree before any operation proceeds.
Each incorrect PIN attempt permanently destroys a one-time physical slot inside the secure element chip. Only a correct PIN produces valid cryptographic output; wrong attempts yield nothing usable. This limits brute-force attacks in hardware, not just through a software attempt counter.
If you don't need Bluetooth, wireless charging, the aluminum/IP67 build, or the Safe 7's dual-chip architecture specifically, the Safe 5 delivers the same open-source firmware transparency for meaningfully less. The Safe 7 makes sense if those specific extras matter to you.
Yes, the Universal firmware supports 8,000-plus coins and tokens across major chains including Bitcoin, Ethereum, Cardano, BNB, XRP, Dogecoin, and Polygon, plus ERC-20 tokens like USDT, USDC, and DAI.
Yes, Trezor offers a separate Bitcoin-only firmware version at the same price as the universal model.
Only through Trezor's own official store. Buying direct is the only way to be confident you're receiving a genuine, untampered device.
More Reviews
BitBox02 – Hardware Wallet Review
Score: 71/100. Swiss-made, open-source, and genuinely clever, but sources disagree on whether multisig still works.
Read More
Ledger Flex – Hardware Wallet Review
Score: 76/100. Best chip Ledger makes, but closed-source firmware, the Recover controversy, and two breaches still linger.
Read More
NGrave Zero – Hardware Wallet Review
Score: 62/100. The "EAL7 wallet" is real, but the actual secure element underneath is a lower EAL5+ chip.
Read More
Trezor Safe 7 – Hardware Wallet Review
Score: 78/100. Fully auditable TROPIC01 chip, undercut by a real Ledger Donjon laser fault-injection disclosure.
Read More