So I was trying to install firmware in a newly purchased Trezor Safe 3 and keep getting the "malformed protocol format" error post which the device disconnects.

Tried all of these:

- Uninstalled and reinstalled suite
- Tried on different Chromium browsers
- Tried with Zadig driver
- Tried with bootloader mode
- Tried after switching off VPN and Malware scanner
- Added Trezor suite to list of apps allowed by Windows Defender
- Tried different USB C cables
- Tried on different devices and phones

Laptop uses windows 11. Phone uses Android 17.

It's my first Trezor device.
I do not have any other hardware wallet suites running on the devices I attempted.

I do not see a red display screen, that seems to load just fine.

Would appreciate any suggestions that might help resolve this. Have added an image for reference.

Jusy got the free Trezor from Coingecko (old Model T), just to see how a Trezor works and if it's better than a Ledger.

Want to verify the address, a massive pop-up hides the compleet address i want to check. Lol, who thought that was a good idea?

In light of the news surrounding pho, is using the Trezor web app suite safe to use ?

Hey guys,

Since I can’t edit the title of my original post, I’m creating a new one to suggest a potential feature:

https://www.reddit.com/r/TREZOR/comments/1xcaqdv/browser_passphrase_typing/

For those using long, complex passphrases who want to enter them directly on the Trezor screen rather than on a keyboard, it would be great to have an approach similar to seed recovery.

When recovering a seed phrase, we can start typing the first few letters of each word and select from auto-suggested words, making the process much faster. The same concept could be applied to passphrases, especially for those who prefer never to enter them on a computer or phone keyboard for security reasons.

It could also support dictionaries beyond BIP39, such as Diceware. Users could select their preferred dictionary in the device settings and choose whether to enable word suggestions by default.

This would make entering long passphrases significantly faster and more convenient without compromising the security benefit of entering them directly on the device.

What do you think? Would this be a useful feature to have?

Just a simple idea, this implementation should make future supply chain attack extremely difficult. The plan is to make all trezors kept inside a digital signature protected box before shipping.

The box contains a battery that lasts for months(or longer), an independent secure processor. The secure processor periodically sign a message with the current time plus the trezor device’s serial code that is inside the box. The box is covered by dense thin wires, and the wires are organized in a way that any attempt to open the box must break them.

Once the wires are broken in any way, the secure processor for the packaging should self destruct immediately. And no further signed timestamps would be issued after first opening. When user receives the trezor package, they could always check the time signature stored in packaging box, and verify if the package has been opened previously. If the timestamp stopped before user receives package, then the device should be considered tampered. Supply chain attackers would not be able to fake an intact package, because they cannot sign valid time signatures.

In this manner, as long as the master key that sign these packaging secure processors are still safe, nobody could counterfeit trezor product.

Hello there!

I have a suggestion to the team.

Can you push a firmware update so that the passphrase typed in the pc goes and shows encrypted at the device?

I am very skeptical to use my device after all the supply chain attacks.

Im setting up my trezor 7. With the option of the SLIP39, Im curious to hear people’s opinions about why they pick SLIP over BIP and vice versa. Is it just a preference? Better security?

Hey /u/stickac /u/slush0

How can be 100% sure the browser pop-up won’t leak or send the passphrase to any external play when entering the passphrase? I can’t do it on screen because is too long and require too much time and effort but reading about all the PHP and hacks nowadays the browser typing scares me too.

Can this be even improved by you or us at some way?

Thanks

Be honest: would you buy a Ledger now?

All I can see over the internet is people worried about their ledgers, opening them to see if there's anything strange inside.

I am not a hater of Ledger (although would never buy one due to close source), neither am I a trezor fanboy, but trust is something very hard to earn and very easy to lose.

In general I think everyone is losing right now: Ledger got a pretty bad reputation damage and the entire auto custody industry also got a hit. If Trezor goes into a similar issue then we are in a big trouble.

It’s not a fun question, but it’s an important one. Self-custody means no one can take your coins. It also means no one can recover them for your family unless you’ve planned for it.

How many of these can you honestly tick?

1. Someone I trust knows I own bitcoin.
2. They’d know where to find my Trezor and backup.
3. There are written instructions they could follow without me.
4. No single person (including them) could access my coins today.
5. I’ve reviewed my plan in the last year.

To enter, comment

- We’ll randomly pick 2 winners from all entries next week.

- Please don’t share where or how you store your backup. General approaches are great, specifics aren’t.

⚠️ We’ll announce winners in this thread only. Trezor will never DM you first or ask for your wallet backup.

How important is this? Sometimes I just use an address I used before but I never spend from these addresses.

Hi everyone,

I’m trying to place an order on the official Trezor Shop using a debit card.

The problem is that my billing address is different from my shipping address. Both are located in the US.

Unfortunately, the checkout doesn’t seem to provide an option to enter a separate billing address. My card keeps getting declined, and I got confirmation from the bank that's due to the fact that the billing address does not match.

Has anyone experienced this issue or found a workaround?

Is there any way to manually enter a different billing address during checkout?

Any help would be appreciated. Thanks!

Just wondering, maybe news on new tropic01 chip too?

Hi everyone,

According to official recommendations, a 6-digit PIN is considered the absolute lower limit for Trezor security. Looking closely at the mechanics, it raises a question: Why?

If the Secure Element chip strictly enforces a permanent, cumulative 16-error limit before wiping the device (with no way to reset the counter without the correct PIN), why do we even need 6 digits? If the digits are 100% random, even a 3 or 4-digit PIN would be virtually impossible to guess within just 16 physical attempts.

Some argue that 6 digits protect against theoretical, high-tech offline laboratory brute-force attacks (if the hardware security is somehow bypassed). But mathematically, that makes no sense either: 1 million combinations (6 digits) can be brute-forced by a standard modern computer in less than a second anyway. If a lab attack is possible, 6 digits won't save you; you'd need a 20+ digit PIN.

So, since an offline brute-force attack is practically impossible due to the Secure Element, and guessing via the screen is blocked after 16 tries, why the 6-digit minimum recommendation? Is it purely to prevent visual "shoulder surfing" from onlookers, or is there something else?

What are your thoughts on this? Do you think a shorter, truly random PIN (like 4 digits) is just as safe in practice?

Thanks!

Hi All,

I have a Safe 3 for quite some time. Since the new cycle has started I wanted to add Safe 7 for ease of use. I bought it direct from Trezor. It arrived in record time without any meaningful description on the outer box of what might be inside (I have very little doubt that any tampering could have taken place while this leg of its journey happened, but ofc that does not mean that a) it did not happen, b) that it did not happen before being delivered to Trezor themselves - I know chances are somehow small taking into account initial Trezor's investigation results).

But I have not yet opened it as I am wondering should I really be setting it up and transferring my cold holdings to it with all the uncertainty currently floating around and while I have a working albeit less convenient but 100% safe setup going.

Logically I should just return it, or keep it until all investigations are finished in 6mo-1yr as I do not need it and at this stage it could be a security risk.

On the other hand I would like to move on with it and be done with it...

What would you do?

One thing that is really annoying me with moving to Trezor is the unwieldy balances of various cryptos I end up with. Balances like XXX.7482947384938594957 annoy the crap out of me. With moving to Trezor for my storage I just cannot see how to clean this up, because no matter what math I use in setting up my transfer I end up with a stupid balance. Is there a user friendly way to fix this? The hiding small balance function is not available I notice.

It’ll reboot whenever I touch the screen when BT is disconnected. I found a thread from the Trezor forum a few months ago with other people experiencing this but I can’t seem to find anything else about it. Someone in the thread mentioned turning off haptic feedback and that has fixed it, but I’m not sure why it would? Curious if anyone else has this issue.

Hey all,

Given the Ledger situation, it may be worth considering a tamper-evident solution for home storage. Of course it doesn’t address a device that was already tampered with before you bought it, but it can help ensure that your device remains free from tampering.

I spent the past few years developing a solution precisely for this. A reusable tamper-evident jar for storing your hardware wallet.

In short, the lid contains thousands of black and white beads, which randomly mix and lock in place when the lid is closed tight, creating a unique pattern. When opened, the beads mix and the unique pattern is destroyed. You can simply compare a before and after image to see if it was opened.

You can learn more how it works on https://www.entropyseal.com/

If you have any questions, I would be happy to answer them here.

Sooner or later, when the cheap credit cracks, when tomorrow sends the bill for the money you lacked, they can laugh at the lifeboat from the top of the deck… sooner or later, everybody starts to check.