Ledger Donjon bypasses Trezor Safe 3 supply-chain protections
Who is affected
An attacker with lab equipment could turn a Safe 3 into a device running malicious firmware that still passes authenticity checks, then sell it to a victim. Devices bought from official sources and the Safe 5 are not affected, according to Trezor.
What happened
On 12 March 2025 Ledger Donjon, the security team of Trezor’s competitor Ledger, published an evaluation of the Trezor Safe 3. According to Ledger, the researchers desoldered the device’s STM32-based microcontroller, used voltage glitching to lower its readout protection and read its flash memory. This let them extract a per-device secret and run modified firmware while the device still passed Trezor’s authenticity check. Ledger names biased seed entropy and manipulated signature nonces as the risks of such firmware.
Trezor’s security portal records the report as received on 12 November 2024. Trezor states that Donjon “successfully reused a previously known attack” to bypass some supply-chain countermeasures in the Safe 3, and that the Safe 5 is not affected because it uses a newer microcontroller. A Trezor spokesperson told Cointelegraph the researchers could not extract private keys or PINs, and Trezor said no user action is required. Asked whether a firmware update could fix it, Trezor answered “Unfortunately not”; neither company has explained how the findings were addressed.
The attack is a supply-chain scenario: it needs the device in hand and the chip removed from the board before the device reaches its owner.
What to do: buy only from Trezor or an official reseller.
Fault injection disturbs a chip's voltage, clock or electromagnetic environment so that it skips a security check or leaks data.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionEntropy is the randomness used to generate secure cryptographic keys or seeds in blockchain and cryptocurrency systems.
Read full definitionA nonce is a sequential number in a blockchain transaction that ensures transactions from the same account process in order and prevents replay attacks.
Read full definitionA private key is the secret number that proves ownership of a crypto address and signs its transactions. Whoever has it controls the funds.
PIN Protection is a security feature that requires a personal identification number (PIN) to access a cryptocurrency wallet or device, preventing unauthorized access.
Read full definitionFirmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.
Read full definitionSources
Independent reporting and research this entry was checked against.
- Trezor — Ledger Donjon's Trezor Safe 3 evaluation (security portal)
- Ledger — Why Secure Elements make a crucial difference to hardware wallet security (12 Mar 2025)
- The Block — Trezor discloses potential vulnerability in older Safe 3 wallets following research by rival Ledger (13 Mar 2025)
- Cointelegraph — Ledger helps competitor Trezor resolve security vulnerability (Mar 2025)
- ForkLog — Ledger identifies vulnerability in Trezor wallets (Mar 2025)
Learn more
Guides on protecting yourself against this type of incident (Hardware attack) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideEvil Maid Attack: Protecting Unattended Hardware Wallets
Someone accesses your wallet while you are away. Hotel rooms, offices, shared spaces — how to detect and prevent physical tampering.
Read GuideProtecting Your Hardware Wallet from Physical Theft
What happens if someone steals your hardware wallet? How to set up layers of protection so theft alone cannot compromise your crypto.
Read GuideFault Injection
Fault injection disturbs a chip's voltage, clock or electromagnetic environment so that it skips a security check or leaks data.
Side-Channel Attack
A side-channel attack in cryptocurrency and blockchain targets indirect information, like power usage or timing, to extract sensitive data from a system or device.
Secure Element
A secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Evil Maid Attack
An evil maid attack is a physical security threat where an attacker gains temporary unsupervised access to a hardware wallet to tamper with it, install malicious firmware, or extract private keys.
Cite this entry
WalletInsights. “Ledger Donjon bypasses Trezor Safe 3 supply-chain protections”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/ledger-donjon-trezor-safe-3-glitching-2025/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.
All Trezor incidents
- Suspected implant in a Trezor Safe 5 sold by CryptoBilis
- Breach at shipping provider ShipMonk exposes data of up to 80,689 Trezor customers
- Laser fault injection bypasses firmware checks on Trezor Safe 7's TROPIC01 chip
- EUCLEAK side channel in Infineon ECDSA library reaches Trezor Safe 3 and Safe 5 chip
- Trezor support portal breach exposes 66,000 contacts