Coldcard vs. Trezor Safe 7

Encrypting a channel is not the same as removing it. Part of how hardware attacks work is through probing: sending inputs, observing responses, and reading feedback from device logs. A USB port or Bluetooth radio provides that feedback channel regardless of whether the data traveling over it is encrypted. The Safe 7 uses THP (Trezor Host Protocol) to encrypt both connections, which impedes successful attacks, but does not remove the attack surface itself.

Air-gapped signing is the solution to this type of attack. With QR code or MicroSD signing, there is no live connection or channel through which an attacker can probe or receive responses. On the Coldcard Q, an unsigned transaction is scanned as a QR code, signed on the device, and displayed as a new QR code to be returned and broadcast. On the Mk5, the same workflow runs over a MicroSD card. There is no signal intercept, no log to read, and no feedback loop to test. QR signing is also incredibly fast, as scanning a code takes seconds and doesn't require device pairing or a cable connection.

The difference comes down to architectural design philosophy. The Safe 7 prioritizes connectivity using Bluetooth and USB, and focuses engineering efforts on hardening those channels. Coldcard takes a security-first approach by treating any connection as a potential attack surface and removing it if possible. Air-gapped signing is not a limitation in this model, rather it's an intentional security feature.

The Safe 7 is a genuine security improvement over earlier Trezor hardware. It added two dedicated secure elements, which are hardened against a class of physical extraction attack that Kraken Security Labs identified as a Trezor device vulnerability in 2020. That vulnerability affected the Trezor One and Model T, where the device could be compromised in roughly 15 minutes with physical access. On the data side, Trezor has disclosed two third-party breaches, neither of which exposed financial information or physical addresses. Coinkite has no documented customer data breach on record.

The core difference is how the devices treat connectivity. The Safe 7 accepts connectivity as useful and hardens those channels through encryption, dual secure elements, and protocol-level protections. Coldcard treats any connection as attack surface and removes it. This means air-gapped signing via QR code or MicroSD is the standard workflow, rather than an optional mode.

Unlike Ledger, both Trezor and Coldcard publish fully open-source firmware. For users comparing all three, that shared standard separates both from Ledger. Within a Trezor vs. Ledger vs. Coldcard comparison, air-gap architecture, Bitcoin-only design, and seed management depth are the distinguishing factors. The Ledger comparison is covered in full at coldcard.com/compare/coldcard-vs-ledger-nano-x/.

The Safe 7 offers multi-crypto support or a Bitcoin-only version. The multi-crypto firmware includes availability for Ethereum, Solana, and thousands of other networks and tokens. The Bitcoin-only firmware is available as a separate firmware version, which reduces the codebase footprint and complexity. Coldcard implements only the Bitcoin protocol at the firmware level, with no configuration needed. A smaller codebase has fewer paths to audit and fewer potential points of failure.

Instead of physical buttons and air-gapped signing, the Safe 7 offers a touchscreen and Bluetooth. These are deliberate user-experience design choices for people who prefer a connected and tactile workflow. The tradeoff is a permanent wireless radio on the device, active any time it's powered on, and a USB or Bluetooth requirement for every signing operation. Air-gapped signing on Coldcard devices provides a signing experience without a wireless interface on the device.

Several Coldcard security features are absent from the Safe 7. The Safe 7 does not include anti-phishing phrases on every unlock, a duress wallet PIN, BIP-85 child seed derivation, Seed XOR, user-contributed entropy, or serialized tamper-evident packaging. Both Coldcard models include all of those features.

The right device depends on what you hold and what risks matter. If you want to manage a multi-crypto or multi-token portfolio on a single device, or if you want to pair your device with your phone or computer for signing over Bluetooth, the Safe 7 provides those options capably. If Bitcoin is your primary or exclusive holding and you want a security-first device that has robust key management and customization options, Coldcard is the right choice.