A Trezor firmware update changes the software running on the hardware wallet, not the balances recorded on a blockchain. The normal process is straightforward, but a failed installation or disconnected cable can wipe the device. Before updating, verify Trezor Suite, confirm that the correct wallet backup is recoverable, account for every passphrase wallet and prepare a stable connection. If the device reports unofficial firmware or fails an authenticity check, stop and investigate instead of treating the warning as an ordinary update error.
Last reviewed: October 30, 2026. Trezor models, firmware versions, mobile support, bootloader behavior and recovery instructions can change. Use the current official guide for your exact model and treat instructions shown by the genuine Trezor device as controlling information. Never enter a wallet backup into a website, ordinary desktop field, support chat or unsolicited recovery tool. This independent guide is educational and is not affiliated with Trezor or SatoshiLabs.
What a Trezor firmware update actually changes
Firmware is the software executed by the hardware wallet. It controls the device interface, key operations, supported signing rules, security checks and communication with wallet applications. Updating it can add features, correct bugs, support protocol changes and patch vulnerabilities.
The update does not move coins between blockchain addresses. Bitcoin, ether and tokens remain recorded by their respective networks. The Trezor stores or derives the private keys that authorize transactions from those addresses. If an update wipes local device storage, the blockchain balances remain where they were, but access must be reconstructed from the wallet backup and any applicable passphrase.
Trezor Suite, firmware, bootloader and backup are different layers
| Component | Role | What an update or failure can affect |
|---|---|---|
| Trezor Suite | Desktop, web or mobile interface used to manage accounts and device actions | Application features, displayed data and update workflow |
| Firmware | Operating logic on the Trezor device | Device behavior, supported features and signing |
| Bootloader | Installs and verifies firmware before it runs | Firmware installation, signature checks and update mode |
| Boardloader | Protected root layer on supported models that verifies the next boot stage | Device boot integrity; model-specific and not an ordinary user update |
| Wallet backup | Recovery information from which wallet keys are reconstructed | Restores access after a wipe, loss or replacement |
| Passphrase | Optional user-chosen input creating a separate wallet | Required exactly to reopen that passphrase wallet |
Updating Trezor Suite is not the same as installing device firmware. A fake Suite download can be dangerous even when the Trezor firmware itself is official, while an authentic Suite can warn that a connected device or its firmware is suspicious.
Why firmware updates matter
Hardware-wallet security is not frozen on the purchase date. Blockchains, transaction formats, host operating systems and known attack techniques change. A firmware release can include security fixes, usability improvements, additional checks and compatibility changes.
That does not mean every update should be started immediately in the middle of an urgent transfer. A safe update is scheduled maintenance. Read the release notes, prepare recovery information and allow enough time to troubleshoot. If Trezor marks a release as security-critical, prioritize it after establishing a valid recovery path.
Can a firmware update steal or delete your coins?
A legitimate update does not delete blockchain balances. It can, however, erase the device’s local wallet state if installation fails or if a security rule requires a wipe. Without a valid backup and passphrase, that access loss can become permanent.
A malicious update prompt creates a different risk. A fake website or application may ask for recovery words and use them to recreate the wallet elsewhere. The attacker can then sign transfers without possessing the Trezor. No ordinary firmware update requires typing the wallet backup into a computer or phone.
Read the changelog for the exact model
Trezor publishes separate firmware histories for Safe 7, Safe 5, Safe 3, Model T and Model One. Confirm the device model, installed version, proposed version and release date. Do not apply a Model One downgrade table or bootloader instruction to a Safe device.
Look for:
- security fixes and compatibility changes;
- new or removed features;
- special steps for old firmware;
- changes to Universal or Bitcoin-only firmware;
- known limitations affecting your operating system or connection;
- a source-code release corresponding to the displayed version.
Use the current changelog rather than an old video whose example version has become obsolete.
Verify Trezor Suite before trusting an update banner
Start from a saved official Trezor URL, not a search advertisement or link in an unexpected email. Official documentation points users to the Trezor Suite page and the verified Trezor GitHub release repository. Desktop installers are available for supported Windows, macOS and Linux environments, while web and mobile capabilities differ.
An advanced user can verify a downloaded Suite installer with the detached signature and Trezor signing key. A successful cryptographic signature proves that the file was signed by the corresponding key, but the key fingerprint must itself come from a trusted official source. Verifying a signature against a key downloaded from the same fake page would not establish trustworthy provenance.
Locate the wallet backup before updating
Trezor recommends having the wallet backup available before a firmware update because an interrupted installation can wipe the device. “Available” should not mean photographed, copied to cloud storage or placed next to the computer. It means you know where the protected physical backup is and can access it if recovery becomes necessary.
Identify its format before proceeding:
- 12-, 20- or 24-word backup as applicable;
- Single-share or Multi-share backup;
- number of shares and recovery threshold;
- whether the intended wallet also uses a passphrase;
- whether the backup belongs to this device and wallet.
A list of valid words can still be the wrong wallet backup. Verify the relationship using Trezor’s supported check rather than assuming that the envelope nearest the device is correct.
Perform a dry-run backup check
Trezor provides a check-backup workflow that simulates recovery and compares the entered backup with the wallet currently stored on the device. The device reports whether it matches without replacing the active wallet.
Begin the process inside official Trezor Suite and follow the device display. Enter words by the model-specific secure method. Do not type the complete backup into an ordinary Suite field, browser prompt or third-party checker.
A successful dry run establishes that the checked backup corresponds to the wallet state on the device. It does not verify a forgotten passphrase, guarantee that every Multi-share copy remains readable or prove that storage will survive future damage. Treat those as separate checks.
Account for passphrase wallets separately
A passphrase is not stored in the ordinary wallet backup. The same backup combined with a different passphrase produces a different wallet. A typo does not generate an “incorrect password” warning; it opens another valid, usually empty, wallet.
Before updating, determine whether any important account uses a passphrase and whether you can reproduce it exactly, including capitalization, spaces, punctuation and keyboard layout. Do not add the passphrase to the same physical or digital record as the wallet backup merely for convenience.
After recovery, the base wallet can appear correctly while a passphrase account looks empty. That does not mean firmware deleted the coins. Confirm that passphrase support is enabled and that the exact original input is being used.
Prepare the physical update environment
Reduce avoidable interruption risk:
- use a reliable data-capable USB cable;
- connect directly rather than through an unreliable hub;
- use a stable computer and power source;
- disable sleep long enough to complete the operation;
- close software that repeatedly claims the hardware-wallet connection;
- allow enough time for a second step or recovery;
- keep the computer and device physically under your control.
A charging-only cable can power a device without carrying data. If Suite cannot see the Trezor, test a known data cable and another trusted port before treating the problem as firmware corruption.
Safe Trezor firmware update workflow
- Open the verified Trezor Suite application or official supported web interface.
- Connect the intended Trezor and confirm the model.
- Verify that the wallet backup matches through the supported dry-run check.
- Confirm whether passphrase wallets exist and that their passphrases are recoverable.
- Open Settings and the Device section.
- Record the current firmware version and firmware type.
- Read the official changelog for the proposed version.
- Select the official Update available or Update now action.
- Review the current and proposed version in Suite.
- Allow the device to restart in bootloader mode when instructed.
- Read the version and warning on the Trezor screen itself.
- Physically confirm only if those details match the intended update.
- Keep the cable, device and host stable while installation progresses.
- Wait for the device to restart and reconnect.
- Unlock it normally, then verify firmware version, accounts and receiving addresses.
Some older Model One versions can require an additional bootloader or intermediate step. Follow the current on-screen process instead of disconnecting after the first apparent restart.
Trust the device screen for physical confirmation
A compromised computer can display false instructions, but it cannot silently press a physical confirmation on the hardware wallet. Read the Trezor screen for the action and version. Cancel if the device describes an unexpected wipe, unofficial firmware, bootloader unlock or version.
The trusted display does not determine whether you personally intended the update. It shows what the device is being asked to approve. You must compare it with the official release and your plan.
What bootloader mode means
The bootloader is the stage that verifies and installs firmware. Entering bootloader mode during a normal update is expected. A device without valid firmware can also enter update mode so that firmware can be installed.
Bootloader mode alone does not prove compromise. The surrounding details matter:
- Did you intentionally start an official update?
- Does the device show the expected model and version?
- Is there an unofficial-firmware warning?
- Does Suite report an authenticity or hash mismatch?
- Was the device new but already contained firmware?
Do not follow an online stranger’s command-line instructions merely because a blue or bootloader screen appeared.
Boardloader, bootloader and firmware verification
Supported Trezor models use chained boot stages. A protected boardloader can verify the bootloader, and the bootloader verifies firmware signatures and integrity before execution. Exact architecture differs by model, particularly between Safe devices, Model T and Model One.
This chain reduces the chance that arbitrary code can masquerade as normal official firmware. It does not make every warning safe to ignore. Deliberately installing custom firmware or unlocking certain protections changes the assumptions that Trezor Suite can make about the device.
Firmware signature, revision and hash checks
These checks answer related but different questions:
| Check | Main question | Possible warning |
|---|---|---|
| Firmware signature | Was the firmware authorized by the expected signing keys? | Unofficial firmware warning |
| Revision check | Do the reported version properties and RevisionID match a known release? | Authenticity or revision-check failure |
| Firmware hash check | Does the installed firmware content match the expected official binary? | Possible altered or counterfeit firmware warning |
| Safe-device authentication | Can the hardware prove expected factory authenticity? | Device authentication failure |
Trezor Suite performs supported checks automatically. A successful check is useful evidence, while a failure demands investigation. It is not a prompt to disable security controls simply to make the banner disappear.
How the firmware authenticity check works
Trezor documents a firmware authenticity process that compares firmware properties, including its version and RevisionID, against known release data. Suite contains a local database and can consult an official remote repository when a version is not available locally. Some checks can therefore operate offline when the relevant data is already present.
If the properties do not match, Suite can block ordinary functionality and show a warning. Do not assume the alert is a harmless result of using an old version. Record the exact message, Suite version, device model and firmware version, then follow the official support procedure.
How the firmware hash check differs
The hash check is designed to identify firmware content that has been altered even if the reported version looks familiar. Trezor Suite can issue a mathematical challenge that official, matching firmware is expected to satisfy. Current support depends on model, firmware generation and whether the required binary is available to Suite.
A skipped check is not the same as a failed check. For example, an outdated version may not satisfy the conditions under which a particular Suite installation performs the comparison. Read the current official explanation before drawing conclusions.
Firmware authenticity is not the same as device authenticity
Firmware checks evaluate software. Safe-device authentication uses hardware-backed material to help establish that the device is genuine. Packaging seals add supply-chain evidence, but they are not cryptographic proof. The number printed on Trezor packaging is not a device serial number that support can use as a complete authenticity test.
A genuine device can encounter a firmware problem, and a counterfeit shell can imitate packaging. Evaluate purchase source, packaging, initial no-firmware state, hardware authentication and firmware checks together.
A new Trezor should not arrive with user firmware installed
Trezor states that devices ship without firmware and that official setup installs it. If a newly purchased device reports that firmware is already installed before you have initialized it, stop.
- Do not generate a wallet backup on that device.
- Do not enter an existing backup.
- Do not transfer funds to addresses it displays.
- Preserve the packaging and order details.
- Contact Trezor through the official support route.
Do not “fix” the situation by wiping and continuing unless official support has established why the device was in that state.
What happens if the update wipes the device?
An interrupted or failed installation can remove the wallet state held by the Trezor. The device may return to setup or recovery mode. This is serious but recoverable when the correct backup and passphrase are available.
The safe response is:
- Preserve the exact error message and do not install files from a search result.
- Reconnect with a reliable cable and reopen verified Trezor Suite.
- Complete official firmware installation if the device has no valid firmware.
- Select the intentional Recover wallet workflow.
- Enter the wallet backup through the model-specific device procedure.
- Enable passphrase wallets if they were previously used.
- Open the exact passphrase and account type.
- Compare a known receiving address before moving funds.
If you cannot confirm the backup, do not repeatedly experiment with recovery words in online tools. Seek official procedural guidance without revealing the words.
Why the recovered wallet can appear empty
An empty account after recovery commonly indicates a different wallet context rather than erased blockchain history. Possible causes include:
- a different wallet backup;
- missing, mistyped or differently normalized passphrase;
- wrong Bitcoin account type or derivation path;
- wrong network or coin account;
- accounts not yet rediscovered in Suite;
- an address history that belongs to another wallet.
Compare known addresses and transaction history. Do not send a test payment to a newly displayed address until you have established that it belongs to the intended recovered wallet.
What to do if firmware authenticity fails
New, uninitialized device
Stop using it, do not generate or enter a wallet backup and contact official Trezor support. A passphrase cannot make an unknown counterfeit device trustworthy because a malicious device controls what it displays and how it handles inputs.
Previously initialized device
Treat the warning as potential exposure. Do not disclose the backup to support or an online “verification” service. Follow Trezor’s current incident instructions for the device and Suite version. If the backup may have been generated by or entered into counterfeit hardware, create a new wallet with a new backup on trusted hardware and move funds according to an independently verified plan.
Moving funds from a suspect device is an incident-response operation. Confirm destination addresses on trusted hardware and beware of direct messages offering urgent recovery assistance.
Unofficial firmware is an advanced choice, not an update fix
Trezor’s open-source design allows advanced users to inspect and, on supported devices, install custom firmware. Such firmware is not equivalent to a routine signed release. The device should display prominent warnings, and installation can wipe storage.
Do not install custom firmware to solve a connection problem, unlock a token or recover a missing balance. Anyone directing a beginner to a binary hosted on a file-sharing site should be treated as hostile until proven otherwise.
Unlocking a Safe-device bootloader can be irreversible
Trezor warns that unlocking the bootloader on supported Safe devices is intended for advanced users and permanently affects authenticity behavior. The device’s attestation material can become inaccessible, Suite can show a non-authentic warning on every connection, and reinstalling official firmware does not necessarily restore the original state.
Do not confuse entering ordinary firmware-update mode with authorizing an irreversible bootloader unlock. Read the exact action on the device screen.
Firmware downgrade risks
A downgrade can remove security fixes, reduce compatibility and wipe the wallet depending on the source and destination versions. Allowed transitions differ among Model One, Model T and the Safe family. A table copied months earlier can become incomplete after new releases.
Use only the current official custom-firmware page for the exact model. Before any downgrade:
- verify the wallet backup and passphrase;
- determine whether the transition wipes storage;
- understand why the older version is required;
- verify the firmware file and source;
- plan how to return to the current official release;
- accept that unofficial firmware may trigger persistent warnings.
Desktop, Android and iOS differences
Trezor’s update guide currently documents desktop and supported Android workflows. Mobile support depends on model, connection and current Suite release. The official guide states that firmware updating through iOS is not currently supported and directs users to a computer for that operation.
Do not work around a platform limitation with an unofficial mobile application. Recheck the live compatibility page because support can change after this article’s review date.
Post-update verification
After the device restarts:
- Confirm Suite reports the expected firmware version and type.
- Look for persistent firmware, revision or device-authentication warnings.
- Unlock with the normal PIN; do not enter the wallet backup merely because an update completed.
- Check base-wallet accounts and balances.
- Open each required passphrase wallet deliberately.
- Compare at least one known receiving address on the Trezor display.
- Review newly introduced features before using them.
- If needed, perform a small transaction and verify every detail on-device.
A balance displayed by Suite is not enough to verify a destination address. Use the device screen when receiving or sending.
Pre-update checklist
- Trezor Suite came from the official website or verified repository.
- The device model and current firmware version are recorded.
- The proposed version appears in the official changelog.
- The correct wallet backup passed the supported dry-run check.
- All required Multi-share components are available.
- Any passphrase can be reproduced exactly.
- A stable data cable, port and power source are ready.
- No urgent transaction depends on immediate device access.
- The host is trusted and free of unexplained update pop-ups.
- No one has asked for the wallet backup.
- The model-specific recovery guide is bookmarked.
- There is enough uninterrupted time to recover if a wipe occurs.
Troubleshooting guide
| Problem | First safe action | Do not |
|---|---|---|
| Suite does not see the device | Verify Suite, data cable, port and connection permissions | Enter the backup into a browser extension |
| Update appears stuck | Preserve the message and follow official model troubleshooting | Flash a binary sent through chat |
| Device restarted in bootloader | Check whether the intended official update is still in progress | Assume every bootloader screen is an attack |
| Device was wiped | Install official firmware and recover through the authentic device | Send the backup to support |
| Recovered wallet is empty | Check backup, passphrase, account type and known addresses | Create transfers before identifying the wallet |
| Authenticity check failed | Stop and use official incident instructions | Disable the check merely to remove the warning |
| Unofficial firmware warning | Determine the device history and installed source | Use it for significant funds without understanding why |
| New device already has firmware | Stop setup and contact official support | Wipe and continue as if it were normal |
Common firmware-update mistakes
Starting from an email or advertisement
Urgent “critical update” messages are a common phishing route. Open Suite independently from a verified installation.
Having a backup but never testing it
A transcription error, wrong envelope or incomplete Multi-share set may be discovered only after the device is wiped. Use the supported check before maintenance.
Saving a digital seed copy for convenience
Photography and cloud notes turn an offline hardware-wallet backup into remotely stealable data.
Confusing PIN and passphrase
The PIN unlocks the device. The passphrase derives a separate wallet. Neither substitutes for the wallet backup.
Disconnecting after the first restart
Old versions or specific models can require multiple stages. Wait for the official completion message.
Ignoring the Trezor screen
The host can be misleading. Confirm the action and version displayed by the hardware wallet.
Disabling authenticity checks
A warning is evidence to investigate. Removing the control does not make the firmware genuine.
Using downgrade as generic troubleshooting
Downgrades can wipe storage and restore known vulnerabilities. Use them only for a defined, documented reason.
Frequently asked questions
Is it safe to update Trezor firmware?
Official updates are a normal part of device maintenance. Risk is reduced by verifying Suite, checking the wallet backup, reading the changelog and maintaining a stable connection. No update process is a substitute for recoverable backup planning.
Can a firmware update erase my Trezor?
Yes. Trezor warns that an interrupted or failed installation can wipe device memory. The correct wallet backup and passphrase can restore the same wallet.
Does a wipe delete my coins?
No. Blockchain balances remain at their addresses. A wipe removes the device’s local ability to derive or use the keys until recovery.
Do I need the wallet backup before updating?
Trezor recommends having it available and verified. Updating without a recoverable backup risks permanent access loss if the device wipes.
Should I type my seed into Trezor Suite after an update?
No ordinary update requires recovery words in a computer field. If intentional recovery is necessary, follow the model-specific procedure and enter the backup through the authentic device workflow.
What if the cable disconnects?
Reconnect using a reliable data cable, open verified Suite and follow official firmware-installation or recovery instructions. Be prepared for the device to have wiped.
What is bootloader mode?
It is the device stage used to verify and install firmware. It is expected during updates and can also appear when no valid firmware is present.
What is the firmware authenticity check?
It compares reported firmware properties such as version and RevisionID with known official release data. A mismatch triggers a serious warning.
What is the firmware hash check?
It checks whether installed firmware content corresponds to the expected official binary rather than relying only on the displayed version.
Why is my wallet empty after recovery?
The usual causes are a different backup, missing or mistyped passphrase, wrong account type, wrong network or accounts not yet rediscovered. Compare known addresses before taking action.
Can Trezor support ask for my backup?
No legitimate support investigation requires your wallet backup, PIN or passphrase. Anyone requesting them can take control of the wallet.
Can I downgrade firmware?
Some model-and-version combinations permit it, while others wipe storage or are not supported. Use only the current official table for the exact device.
Can I update with Android?
Current official guidance supports firmware updates for certain devices through Trezor Suite on Android. Verify model and connection compatibility in the live guide.
Can I update with an iPhone?
Trezor’s current update guide says firmware updating through iOS is not supported and directs users to a computer. Recheck because platform support can change.
What does unofficial firmware mean?
It means the device is not running an ordinary firmware release signed and recognized under the expected official process. Treat the warning as a changed security model, not a cosmetic notice.
What if a new Trezor already has firmware?
Stop setup and contact official Trezor support. New devices are expected to install firmware during initial setup rather than arrive initialized with it.
Does an update change my receiving addresses?
Not when the same backup, passphrase and account derivation are restored. Different addresses indicate a different wallet context or account configuration and should be investigated.
Will an update reveal my passphrase?
A legitimate update should not require disclosing it to a website or support. Passphrase entry follows the current device and Suite workflow only when opening that wallet.
Final assessment
A safe Trezor firmware update begins before the Install button. The decisive preparation is proving that the wallet can be recovered: verify the correct backup, preserve the Multi-share threshold, account for passphrases and use authentic software. During installation, compare the version on the trusted device screen and protect the physical connection.
A wipe is an availability incident, not automatic coin loss. An authenticity failure is different: it can indicate counterfeit or altered components and should not be bypassed. Knowing that distinction prevents both panic-driven seed exposure and complacent use of a device that should no longer be trusted.
Official Trezor resources
- Trezor Blog — official security announcements, product changes and explanations of new wallet features.
- Trezor — Update firmware — current desktop and mobile update steps, preparation warning and model-specific prompts.
- Trezor — Download and verify Trezor Suite — official downloads, detached signatures, signing key and verification procedure.
- Trezor Firmware Changelog — model-specific versions, release dates, source releases and change notes.
- Trezor — Firmware authenticity check — how firmware version and RevisionID are checked against known releases.
- Trezor — Firmware hash check — how Suite detects altered firmware content and when the check runs.
- Trezor — Firmware update issues — official recovery direction when an update fails or wipes the device.
- Trezor — Authenticity check failed — incident response for new and previously initialized devices.
- Trezor — “Firmware is already installed” — what to do when a newly purchased device unexpectedly contains firmware.
- Trezor — Unlocking the bootloader — irreversible effects and authentication warnings for advanced Safe-device users.