Image credit: Shutterstock
Trezor said Safe 7 users do not need to take action after Ledger’s Donjon research team found a flaw in the TROPIC01 secure element used in the wallet.
The issue was disclosed on June 3. Trezor said the Safe 7 itself has not been hacked, there is no evidence of real-world exploitation and user funds remain secure.
June 3 Disclosure Finds TROPIC01 Chip Flaw
The flaw was found during an independent audit of the TROPIC01 chip by Ledger Donjon. The issue was reported in January following a laser fault-injection test.
Under lab conditions, researchers were able to extract some chip secrets and bypass firmware signature checks. The same report said Tropic Square later identified a related path that could expose additional chip data.
Safe 7 Uses 3 Independent Hardware Layers
Trezor said Safe 7 is protected by three independent hardware layers. Those layers are the TROPIC01 secure element, an Infineon OPTIGA Trust M secure element and an STM32U5 microcontroller.
Trezor said the components share security duties such as PIN protection, device-authenticity checks and randomness generation. The company said compromising TROPIC01 alone is not enough to gain wallet access.
Trezor Says Keys, Backups and PIN Remain Protected
Trezor said the flaw does not expose private keys, wallet backups or the device PIN. The company’s documentation says the PIN is never stored on the device and the microcontroller cannot override chip-level protections.
Tropic Square’s Safe 7 page also says the seed is not stored in either secure element. Trezor said reaching the seed would require compromise of all three independent hardware layers.
Physical Attack Requires Device and Lab Equipment
The attack requires physical possession of the device, chip-level hardware work and specialized lab equipment. That makes it different from common wallet risks such as phishing, malware or seed-phrase theft.
Trezor said users do not need to migrate funds or replace devices because of this issue alone. The company’s message is that the flaw affects one security layer, not the Safe 7 wallet as a whole.
