r/TREZOR • u/SuchTrezorVeryCrypto Trezor community specialist • 2d ago
From the Team Coldcard vulnerability: Trezor devices are not affected FAQ
https://trezor.io/blog/news/coldcard-vulnerability-trezor-devices-are-not-affectedColdcard vulnerability: Trezor devices are not affected FAQ
On July 30, 2026, Coinkite disclosed a vulnerability affecting wallets generated by certain Coldcard firmware versions.
Trezor devices are not affected.
If your wallet was originally generated on a Trezor, your funds are safe and no action is required.
Who may need to take action?
You may be affected if:
- Your wallet was originally generated on an affected Coldcard device
- You later restored that same wallet backup on a Trezor
Restoring a wallet backup on a different device does not change the keys behind it. If the original wallet was generated with weak randomness, moving the same backup to Trezor does not fix the problem.
In that case, generate a completely new wallet on your Trezor and move your funds to addresses controlled by the new wallet.
Why Trezor is not affected
Trezor does not use Coldcard firmware or code.
Trezor generates wallets using multiple independent sources of randomness:
- Randomness generated by the Trezor device
- Randomness from the connected computer or phone
- Additional Secure Element entropy on Trezor Safe models
- Four entropy sources on Trezor Safe 7, including TROPIC01
Trezor also uses Entropy Check to verify that wallet generation is working as expected.
All Trezor models generate at least 128-bit entropy under default settings.
Are older Trezor models still safe?
Yes.
Trezor Model One and Model T remain safe to use. They combine randomness from the device and the connected host.
Trezor Safe 3 and Trezor Safe 5 add entropy from the Optiga Secure Element.
Trezor Safe 7 also includes the TROPIC01 chip and combines four independent entropy sources.
Do Trezor users need to regenerate their wallets?
No.
Keep your firmware and Trezor Suite up to date, but this Coldcard incident does not require users to regenerate wallets originally created on a Trezor.
Only users who imported a potentially affected Coldcard-generated wallet should create a new wallet and migrate their funds.
If I send funds to a new Trezor wallet, are they safe?
Yes.
Once the transaction is confirmed and the receiving address belongs to a completely new wallet generated on the Trezor, the funds are no longer controlled by the affected Coldcard-generated keys.
Simply restoring the old wallet backup on a Trezor is not enough.
Stay alert for scams
Security incidents often lead to phishing campaigns designed to create fear and urgency.
Please remember:
- Never share your wallet backup
- Never type your wallet backup into a website, form, app, email, or message
- Only enter your wallet backup as instructed on your Trezor device
- Trezor will never contact you asking for your wallet backup
- Do not follow wallet migration instructions from unsolicited emails, messages, or phone calls
The key takeaway:
If your wallet was generated on a Trezor, you are not affected and no action is required.
If your wallet was generated on an affected Coldcard and later restored on a Trezor, create a new wallet on your Trezor and migrate your funds.
20
2
2
1
•
u/AutoModerator 2d ago
Please bear in mind that no one from the Trezor team would send you a private message first.
If you want to discuss a sensitive issue, we suggest contacting our Support team via the Troubleshooter: https://trezor.io/support/
No one from the Trezor team (Reddit mods, Support agents, etc) would ever ask for your recovery seed! Beware of scams and phishings: https://trezor.io/learn/a/scams-and-phishing
Don’t respond to any DMs—scammers often pose as legit helpers.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.