Trezor has disclosed a hardware vulnerability in the Safe 7 chip used in its latest hardware wallet, after an audit by Ledger Donjon found a lab-based attack path. The flaw affects the TROPIC01 Secure Element, a chip developed by Tropic Square, Trezor’s sister company.
Trezor said the issue does not expose user funds, private keys, wallet backups, or PINs. The company also said users do not need to take any action, while Tropic Square confirmed that the flaw affects only one layer in the device’s security design.
Ledger Donjon identified the vulnerability during an independent security audit of the TROPIC01 Secure Element chip. Researchers used a laser fault-injection method to bypass certain chip protections in a controlled lab setting. The attack could reveal one of three secrets used in the Safe 7 security model.
However, Trezor said the finding does not give attackers direct access to a user’s wallet. The company stated that the TROPIC01 chip forms only one of three physical and independent security layers inside the Safe 7 device. Therefore, compromising that chip alone does not unlock the wallet.
The attack also requires physical control of the wallet. An attacker would need to steal or obtain the device, disassemble it, and use specialized equipment. Trezor said this makes the attack difficult outside a lab environment.
Trezor stated, “The vulnerability concerns only the TROPIC01 Secure Element chip, one of three physical, independent security layers.” The company added that compromising TROPIC01 alone is not enough to access the PIN, which remains the final protection layer for funds.
Trezor said user funds ‘remain protected’ despite the chip flaw. The company also said the issue cannot create Safe 7 devices with lasting malicious firmware. According to Trezor, the attack does not expose private keys, crypto wallet backups, or crypto holdings.
The Safe 7 does not store user keys inside the TROPIC01 chip. That design limits what an attacker can gain even after a successful chip-level attack. Meanwhile, Trezor said the remaining two security layers continue to protect the device.
Tropic Square also reviewed the issue and confirmed that no action is required from users. Since the flaw sits in hardware, Trezor cannot fix it through a standard firmware update. Even so, the company said the device remains safe under its layered security model.
Blockchain security firm Cyvers also supported Trezor’s view. Deddy Lavid, CEO of Cyvers, said, “Hardware wallet security should not be evaluated only by whether a chip can eventually be attacked in a lab.” He added that most users face larger risks from phishing, seed phrase theft, malicious blockchain dApps, and blind-signing.
The disclosure shows how hardware wallet makers test devices against advanced attack methods. It also shows cooperation between two major rivals in the hardware wallet market. Trezor said Ledger Donjon’s audit helped identify the vulnerability and supported an open security review process.
Matej Žák, CEO of Trezor, said, “I believe the open process by which this vulnerability was found, examined, and disclosed is the model the industry should hold itself to.” The statement placed the focus on public disclosure and security review.
The timing also comes as the crypto industry moves closer to stricter standards under MiCA, the European Union’s Markets in Crypto-Assets Regulation. Hardware wallet security remains a key issue for users who rely on cold storage to keep assets offline.
Hardware wallets store private keys away from internet-connected software. They reduce exposure to online attacks, although users still need to protect seed phrases and confirm transactions carefully. Trezor’s disclosure shows that chip-level research continues to play a role in testing wallet safety.
For now, Trezor and Tropic Square maintain that Safe 7 users do not need to replace devices or take any extra steps. The company said there is no evidence of real-world attacks or compromised Safe 7 wallets linked to the TROPIC01 vulnerability.
Also Read: Best Hardware Wallets for Bitcoin & Ethereum in 2026: Top Cold Storage Picks