Ledger’s security research team, Donjon, identified a laser fault-injection vulnerability in the TROPIC01 chip used in the Trezor Safe 7 wallet in late January 2026. The companies coordinated the disclosure, which was made public on June 3, 2026, after an additional PIN-related attack path was discovered.
The exploit requires physical access to the device and specialized laboratory equipment, posing no remote or supply-chain risks. Trezor confirmed that user funds remain secure due to the wallet’s three-layer security architecture, where the TROPIC01 chip acts as only one of several independent protection layers.
Both companies are now advocating for industry-wide reporting standards, citing the role of AI in accelerating the timeline between vulnerability discovery and exploitation. They noted that AI can enhance brute-force attacks against weak entropy, referencing a $116 million incident involving Coldcard wallets in July 2026.
Ledger and Trezor have a history of collaborative security research dating back to 2018-2019, including the disclosure of a voltage-glitch vulnerability in 2025. Despite different approaches to hardware design, with Trezor favoring open-source principles and Ledger using proprietary elements, both firms are pushing for a shared disclosure framework.
