Lost or Compromised Trezor? Emergency Response for Device, PIN and Wallet Backup Incidents

A lost Trezor device, a missing wallet backup and an exposed backup are three different emergencies. Losing the hardware does not automatically expose the keys because the PIN and device protections remain. Losing the only backup threatens future recovery. Exposing the backup is more urgent: anyone who obtains enough valid words or shares can restore the wallet elsewhere without possessing the original Trezor.

Last reviewed: October 2, 2026. Trezor models, firmware, recovery workflows, supported assets and emergency instructions can change. Use current official Trezor Suite and documentation. Never enter wallet-backup words into a website, support form, ordinary computer keyboard or unsolicited application. This independent guide is educational and is not professional security, legal or financial advice.

Emergency decision table

First identify what controls the wallet

Crypto is held by blockchain keys, not inside the physical Trezor. The device stores and uses those keys securely. The wallet backup can recreate them, while an optional passphrase derives a separate wallet from the same backup.

An incident response therefore depends on which control elements may be available to another person:

• the physical device;
• the PIN;
• the complete BIP39 or SLIP39 wallet backup;
• enough Multi-share Backup shares to meet the threshold;
• the optional passphrase;
• a computer or phone with an active wallet session.

Do not panic and expose more secrets

Attackers exploit urgency. A search for “recover stolen Trezor” can lead to advertisements, fake support accounts and cloned wallet interfaces that ask for recovery words. Trezor support does not need the wallet backup to investigate a device or transaction.

Before taking technical action, move to a private environment, use a trusted device, verify official domains independently and write down public transaction hashes or account addresses. Do not photograph the backup to send it to anyone.

Scenario 1: the Trezor device is lost

If the wallet backup remains private and the lost device has a strong PIN, loss of the hardware does not automatically mean loss of funds. Trezor states that access without the PIN is highly unlikely, although no physical security assumption should be treated as permanent.

Recommended response:

1. Confirm that the device—not the backup—was lost.
2. Check public addresses through a known explorer without entering secrets.
3. Obtain a genuine replacement from Trezor or an authorized source.
4. Verify packaging and device authenticity through the official setup flow.
5. Recover by entering the backup directly on the new Trezor.
6. Apply the exact passphrase if the wallet used one.
7. Compare a previously recorded receive address.
8. Decide whether the circumstances justify migration to fresh keys.

When a lost device should trigger migration

Recovery alone restores control but keeps the same wallet keys. Move to a new wallet if the device was stolen with the PIN, the PIN may be guessable, the thief can link the device to valuable holdings, the backup location may also be known, or sensitive physical threats exist.

Migration means creating an entirely new wallet with a new backup and transferring every asset. Changing the PIN on a replacement does not change the old keys or disable the missing device.

Scenario 2: the device was stolen

A stolen device deserves a more cautious response than one misplaced at home. Preserve personal safety first. Do not confront a thief to recover hardware.

1. Determine whether the PIN, passphrase or backup may also be known.
2. Monitor public addresses from a safe device.
3. Recover on a genuine replacement if it can be obtained promptly.
4. Create a new wallet with independently generated keys.
5. Verify the new receive address on its trusted display.
6. Send a small test transaction where practical.
7. Move the remaining balances and tokens.
8. Document the theft through appropriate local channels.

What PIN protection does and does not do

The PIN protects access to the physical device. Failed attempts are rate-limited by device security mechanisms, and modern Trezor Safe models add secure-element protections. The PIN is not part of the wallet backup and does not protect a backup that someone restores on another wallet.

A long, unpredictable PIN improves resistance to a stolen-device attack. It cannot protect against a thief who watched it being entered, obtained it through coercion or found it stored beside the Trezor.

What an optional passphrase changes

A passphrase creates a separate wallet derived from the wallet backup. If an attacker has only the backup but not a strong passphrase, the passphrase wallet may remain inaccessible. If both are exposed, that protection is gone.

Do not rely on the passphrase to delay action after backup exposure. A weak or reused phrase may be guessed, and an attacker can work offline. Move assets to a fresh wallet rather than merely choosing another passphrase on top of known backup words.

Scenario 3: the wallet backup is lost but Trezor works

This is an availability emergency. Current funds remain accessible through the working device and PIN, but device failure, loss, reset or a forgotten PIN could make recovery impossible.

Trezor recommends moving funds to a wallet with a new wallet backup. Do not wipe or reset the only working device before the migration is complete.

1. Confirm the current device can unlock and display the intended accounts.
2. Prepare a genuine second hardware wallet where possible.
3. Create a completely new wallet and record its backup offline.
4. Run the official backup check.
5. Verify the new receive address on the new device.
6. Send a small test amount and wait for confirmation.
7. Move all remaining assets, including tokens and NFTs.
8. Check every old account and passphrase wallet before retiring the device.

Why you cannot simply reveal the original backup again

A Trezor normally displays wallet-backup words during the initial backup procedure. It is not designed to reveal the existing secret later on demand. This prevents malware or a person with temporary device access from extracting an easy plaintext copy.

If the backup is gone, the safe response is to use the still-working signer to transfer funds into a newly generated wallet—not to install seed-extraction software.

Scenario 4: wallet-backup words may be exposed

Treat uncertainty as compromise when someone could have photographed, copied or entered the words. An attacker does not need the original Trezor, PIN or physical card. They can restore the keys elsewhere.

1. Use a clean environment and genuine wallet device.
2. Create a new wallet with a new backup generated on that device.
3. Do not reuse or edit the compromised words.
4. Verify the destination address on the new hardware screen.
5. Transfer the most valuable and liquid assets promptly.
6. Move network-native coins needed to transfer remaining tokens last enough to preserve gas.
7. Review NFTs, staking positions, DeFi deposits and less-visible accounts.
8. Stop using every address derived from the old backup.

A new PIN is not enough after backup exposure

Changing the device PIN changes only local device access. It does not change private keys derived from the backup and cannot remotely revoke copies. The same applies to wiping the original Trezor.

Only moving assets to addresses generated from fresh secret material removes the exposed backup’s control over those assets.

Single-share versus Multi-share compromise

A lost Multi-share share cannot be revoked from its existing set. If its location or confidentiality is uncertain, replace the backup configuration before more shares are exposed.

Scenario 5: unauthorized funds are leaving

An unknown outgoing transaction suggests that a key, backup, active session or smart-contract permission may be compromised. Determine whether the transfer came directly from the account or through an approved token spender.

1. Prioritize physical safety and stop communicating with suspected scammers.
2. Move remaining native assets and high-value tokens to fresh keys if possible.
3. Preserve enough gas to move relevant tokens.
4. Revoke malicious allowances only when doing so will not delay a safer migration.
5. Disconnect suspicious dapps and sessions.
6. Save transaction hashes, addresses, times and screenshots without exposing secrets.
7. Report through official wallet, exchange and local channels as appropriate.
8. Retire the compromised wallet permanently.

Direct key theft versus malicious token approval

When the cause is uncertain, fresh keys are the safer destination. Revocation cannot repair an exposed wallet backup.

Use a second hardware wallet when possible

A genuine spare Trezor lets users create and verify a new cold wallet without exposing keys to an internet-connected software wallet. It also allows a test recovery without wiping the original device.

Initialize the spare independently. If the goal is migration after compromise, choose create new wallet, not recovery of the old backup. Restoring the compromised words produces the same compromised keys.

Using a temporary software wallet

Trezor notes that a third-party software wallet may be used during an emergency, but entering a backup into an online device exposes it to a less secure environment. This should not be the default response.

If immediate movement is necessary and no hardware replacement exists, evaluate whether the risk of waiting exceeds the risk of temporary hot-wallet custody. Use reputable software on a clean device, create new keys rather than casually importing exposed keys, and migrate to verified hardware afterward.

How to create the safe destination

1. Obtain a genuine unused or securely wiped supported device.
2. Install official Trezor Suite from a verified source.
3. Run the authenticity check where supported.
4. Select creation of a new wallet.
5. Record the new backup directly from the Trezor screen.
6. Keep cameras, microphones and other people away.
7. Confirm every word in order.
8. Set a strong new PIN unrelated to the old one.
9. Run Check wallet backup before relying on it.
10. Record one public receive address separately for later verification.

Verify the new wallet before moving funds

A rushed migration to an incorrectly backed-up wallet replaces one emergency with permanent loss. Confirm that the new backup matches the device using Trezor’s official simulated recovery check. Never verify by typing words into a website.

If a passphrase will be used, verify the intended passphrase wallet and a known receive address. A different capitalization, space or character produces a different valid wallet without an “incorrect password” warning.

Send a test transaction

For a material balance, first send a small amount to the new address and confirm that it appears in the expected account. Verify the complete destination on the hardware display, not only on the computer.

A test confirms the address and network path but does not test the written backup. The backup check and test transfer solve different problems; do both when time permits.

Plan migration by network and asset

List every account before moving:

• Bitcoin and other UTXO accounts;
• Ethereum and EVM native coins;
• ERC-20 and similar tokens;
• NFTs and collection approvals;
• Solana and other supported ecosystems;
• staking, lending and liquidity positions;
• accounts derived with an optional passphrase;
• legacy account types and less-used derivation paths.

Do not assume the dashboard shows every recoverable account automatically. Add the relevant account types and verify known addresses.

Preserve gas for tokens

Moving an EVM token generally requires the network’s native coin for gas. If all native coin is transferred first, the old address may be unable to send its remaining tokens.

Estimate token and NFT transfers, keep a controlled gas reserve, move assets, then sweep the remaining native balance. Avoid accepting “gas assistance” from unknown parties who request signatures or recovery data.

Bitcoin migration considerations

A Bitcoin wallet may contain many UTXOs across account types. One transaction can consolidate several inputs, affecting fees and privacy. During an active key compromise, speed and confirmation probability may matter more than perfect fee optimization.

Verify the new Bitcoin address on-device, choose an appropriate current fee and monitor confirmation. Avoid replace-by-fee or child-pays-for-parent decisions unless their consequences are understood.

DeFi positions cannot always be transferred directly

Deposited collateral, staking positions and liquidity-provider tokens may require withdrawal, claim, unstake or protocol-specific migration. Each action can take time or introduce smart-contract risk.

Use official protocol interfaces from verified domains, check approval and transaction details on the trusted display and prioritize positions according to accessibility and value. Never reveal the old backup to a “recovery specialist.”

What to do with the old device

After all old accounts are empty and records are preserved, a device still in your possession can be wiped through the official process. Confirm that no remaining funds depend on it and that the new backup has been tested first.

Wiping deletes device data; it does not erase blockchain transactions, revoke copied backup words or cancel token approvals associated with the old addresses.

What if the old device is later found?

If the wallet was migrated because the device disappeared, do not resume using the old keys merely because the hardware returned. Its custody history may be unknown.

Confirm that old accounts are empty, wipe the device and initialize it with a new wallet or use it according to a documented spare-device plan.

Preserve evidence without preserving secrets

Useful incident records include public wallet addresses, transaction hashes, token contracts, timestamps, scam domains, email headers, shipment records and official support case numbers. These can help exchanges, investigators or insurers understand the event.

Do not include recovery words, private keys, complete passphrases or device PINs. Public evidence and signing secrets must remain separate.

Beware of crypto recovery scams

• Fake Trezor support requests the wallet backup “for verification.”
• A caller promises to freeze blockchain funds after receiving a fee.
• A website asks users to synchronize or validate the device with recovery words.
• A stranger claims to reverse confirmed transactions.
• A recovery company asks for remote access to the computer containing wallet software.
• A social account sends a private link instead of using official support.

Confirmed decentralized transactions generally cannot be reversed by Trezor. Legitimate support can explain product steps but cannot reconstruct missing secrets or guarantee stolen-fund recovery.

Build an emergency plan before an incident

• Keep an offline inventory of wallet types and public addresses.
• Store the backup separately from the device and PIN.
• Verify the backup periodically through the official device process.
• Maintain a genuine spare hardware wallet when the balance justifies it.
• Know how to obtain official Trezor Suite and support.
• Record which networks require gas for token migration.
• Document passphrase recovery without storing it beside the backup.
• Give heirs or trusted responders procedural information without premature control.
• Review token approvals and connected dapps routinely.

Emergency migration checklist

• The exact compromised component has been identified.
• A clean device and verified official software are being used.
• The destination wallet has entirely new secret material.
• The new backup is complete, offline and checked on-device.
• Receive addresses are verified on the trusted display.
• A test transfer succeeded where time permits.
• Every network, token, NFT and DeFi position is inventoried.
• Enough native coin remains for required gas.
• Passphrase wallets and less-visible accounts are checked.
• Public evidence is saved without storing private secrets.
• The old wallet will not be reused after migration.

Frequently asked questions

Can someone access funds from a lost Trezor?

A strong PIN and device protections make unauthorized physical access difficult, but circumstances differ. Recover promptly and migrate if the PIN, backup or physical threat model may be compromised.

Can I recover a lost Trezor without the device?

Yes, if the complete valid wallet backup—and any required passphrase—is available. Enter it directly on a genuine compatible hardware wallet.

What if both my Trezor and wallet backup are lost?

Without the device or sufficient backup material, there may be no way to reconstruct the private keys. Trezor cannot reset or recover them centrally.

What if the backup is lost but the Trezor still works?

Create a new wallet with a new verified backup and transfer the assets while the old device can still sign. Do not wipe the only working device first.

Does changing the PIN protect an exposed wallet backup?

No. The PIN protects one physical device. Anyone with the backup can restore the same keys elsewhere.

Does wiping Trezor invalidate the recovery words?

No. Wiping removes secrets from that device, but the wallet backup can still recreate the same keys.

Should I restore a compromised backup on a new Trezor?

Only as a controlled emergency step when necessary to access and move funds. A new device does not make exposed words secret again; the final destination needs fresh keys.

Can Trezor reverse a stolen transaction?

No. A confirmed blockchain transaction generally cannot be reversed by the hardware-wallet manufacturer. Report the incident promptly, but avoid guaranteed-recovery claims.

Does a passphrase protect a stolen wallet backup?

A strong undisclosed passphrase can protect its derived wallet, but the safety depends on its secrecy and strength. Do not delay migration when the backup may be exposed.

Should I revoke approvals or move funds first?

If the private key or backup is compromised, moving assets to fresh keys is normally more fundamental. If only one token approval is malicious, revocation may contain that specific authority. When uncertain, prioritize a safe destination.

Final perspective

The most important emergency distinction is between losing access and losing secrecy. A lost device with a secure backup is primarily a recovery problem. A lost backup with a working device is a race against future device failure. An exposed backup is a key-compromise incident and requires fresh keys.

Prepare the destination carefully, verify it on trusted hardware and migrate in an order that preserves necessary network fees. Once a wallet backup may be known to someone else, no PIN change, device wipe or support ticket can make those same words private again.

Official sources

• Trezor — Move crypto to a wallet with a new wallet backup
• Trezor — How to use a wallet backup
• Trezor — Funds sent without authorization
• Trezor — Suite security, backup and wipe settings
• Trezor official blog