https://www.coindesk.com/tech/2026/06/02/dnp-trezor-says-users-crypto-is-safe-after-ledger-researchers-uncover-chip-flaw
- Trezor disclosed a security flaw in the TROPIC01 chip used in its Safe 7 hardware wallet after Ledger's Donjon security team identified a successful laboratory attack, but the company says the vulnerability does not put user funds at risk.
- The flaw affects only one of the wallet's multiple security layers and would require physical access, specialized equipment and advanced expertise to exploit, with no evidence of real-world attacks or compromised devices.
An attacker would need physical possession of a device, expensive lab equipment and advanced technical expertise to attempt the attack. There is no evidence the flaw has been exploited in the real world, Trezor said.
No real details provided.
Yeah I was at least expecting coindesk to link to the disclosure. Here it is: https://donjon.ledger.com/blog/tropic01-laser-fault-injection/
Their response: https://www.tropicsquare.com/news-and-events/tropic01-security-advisory-lfi-vulnerability-disclosure-and-mitigation
another good reason to use a passphrase on top of your seed
this is the answer.
I guess the TLDR is: don't carry a loaded Trezor cross-border, which you shouldn't do in any case, because rubber hose. Also, don't keep a loaded Trezor at home or on your person, in case you get raided / arrested. (i.e. nothing changes)
So maybe the real TLDR is: if you have a Trezor, do not say "come and take it", cuz they'll reply "OK, sucker!"
Paper is safer
The core architectural difference at play is the use of a Secure Element (SE) vs. General Purpose MCUs:
An audit exposing a Ledger flaw is a massive reminder: Closed-source firmware means 'Don't verify, trust us.' In contrast, Trezor's open-source architecture means anyone can verify the code, compile it deterministically, and audit it themselves. In security, obscurity is not safety.