Greetings everyone!
Im a safe 3 owner for almost a year now but I always had this lingering question In my mind.
Let’s assume that I wipe the firmware off my Safe 3, which I bought straight from Trezor, and then proceed to make a new seed etc. How does Trezor Suite know or detect if any changes have been made to the hardware inside? Is there a hash that changes if a change is detected, and then compared to an original “factory hash”?
This stems from mostly reading about supply attacks. Thanks!
Basics out of the way first: Trezor’s main chip (MCU) and the secure element (SE) are software-bonded in such a way that you can’t replace one or the other with a bad one. If the pieces in your Trezor don’t match what was installed in the factory, you will not be able to complete the authenticity check.
(Brief draft of how this works: the SE will use public key cryptography to prove to Suite that it belongs to some legitimate Trezor. Buuuut it will only do this if the MCU knows the correct communication key, also installed in the factory. So Suite asks MCU, MCU asks SE, SE responds with proof. Swap out any piece, the chain breaks.)
That said… most hardware changes can’t really be detected by software.
For example: if you write your name in sharpie on the back of your Trezor, that’s a hardware change that Suite will never be able to detect.
More to the point, if you open the Trezor case and solder a sniffer chip on some communication lines, e.g., between the MCU and SE, this is an active piece of hardware that doesn’t have any software-detectable effect.
The defence against this is, things in the real world being expensive.
Your Trezor case is designed to be tamper-evident. It’s difficult to break the case open without you noticing. You’d see a cut along the sides, or the metal backplate would be irreversibly bent out of shape.
Sure, an attacker could make a new backplate, or maybe build a whole new case. But that costs money.
But okay, let’s say you’re in. What are you gonna do next? Install a sniffer? Where? Catching talk between MCU and SE is useless, because the data doesn’t help you get the seed.
You could sniff what is shown on screen, and record the seed words, maybe … but that’s a lot of uncompressed image data. Off-the-shelf chips powerful enough to handle the task are big. And there’s not a lot of space left inside a Trezor. Plus you can’t just leave the chip hanging in the air, it needs all the tiny leads and wires, that shouldn’t touch other leads and wires…
This is all solvable, mind you. You could install a small board with the chip and only connect power and the data lines. Will you fit in the space left? Anyone’s guess! Maybe you’d have to redesign Trezor’s base board. Maybe you’d even need some custom components. The costs are adding up quickly.
Next, how are you getting the data out? By stealing the Trezor? That means your attack needs to be targeted, you need to know who has it, and you need to break into their house. Intercepting a package at the post office is one thing; breaking into a home is wholly another. Risk goes up, costs go up.
Or maybe you want to put in a tiny GSM modem and an antenna … more expensive components to fit in the limited space.
Or maybe you want to do something like Dark Skippy and exfiltrate the data via your public transactions – sure, but that’s a lot of time and money spent on development.
Very soon, you’re in the hundreds of thousands of dollars range.(*)
The crucial question is: will you ever recoup those costs with what you steal? And will you live happily ever after with your takings, or will law enforcement be able to trace you, through all the expensive equipment and custom chips you had to get someone to make somewhere?
Or will you instead spin up a bunch of phishing sites that ask nicely for people’s seeds, from the comfort of your mansion in Abuja, Nigeria, for the cost of tens of dollars for google ad keywords and some cents for site hosting?
If you’re a crypto millionaire, maybe worry about this and don’t rely on a single Trezor device. Better pay a bunch of lawyers to figure out how to handle the whole situation cleverly.
If you’re a regular person, worry more about how you store your backup phrase.
(*) If you want your attack to scale, that is. If you have a single ordinary-person victim in mind, you may be able to get away with doing things imperfectly. Esp. if you can also get them to install a fake Suite that doesn’t actually do the authenticity check.
But when you’re at that point … why are you doing all this difficult electrical work when you could be stealing their seed from their back yard where it is buried.
(or, you know, putting a bag on their head and carrying them off in an unmarked van, then breaking their fingers one by one until they tell you the PIN and all passphrases)
Thank you for this in depth answer! I think you’ve covered me, especially since I’m just a regular Joe, a common nobody.
All this thoughts started because when i bought my Safe 3, the new security tape wasnt available, and the old one usually just falls off, and since i was very excited when i bought mine about 1.5 years ago, i dont remember if i went through all of the proper manual inspection points. Mine has that tiny plastic part that looks weird, but its from the mold injection as i read from the Trezor website.
You covered me from the first paragraph with the MCU and SE. I thought one could “switch” something, and the system wouldnt detect it. Looking forward to seeing what comes next with the fabled “Safe 7” :)!
Hello.
After reading your post above, I realized that the methodology you described appears to match the attack on Ledger devices in October 2026. The attack unfolded in several stages:
In your opinion, how likely is a similar attack on Trezor now, and how much might it cost to carry out?