Compare / Trezor Safe 3 vs Ledger Nano S Plus
Trezor Safe 3 vs Ledger Nano S Plus: firmware, security track record & price
A side-by-side look at how often each device gets updates, how many of those were security-related, and what each costs at the official store today. Numbers come from each maker's own release notes and store pages.
| Trezor Safe 3 | Ledger Nano S Plus | |
|---|---|---|
| Official price | $59 | $69 |
| Current firmware | 2.13.0 (Oct 21, 2026) | 1.7.0 (Oct 1, 2026) |
| Days since last update | 7 days | 27 days |
| Releases, last 12 months | 13 | 5 |
| Security-flagged releases, 12 mo | 7 | 4 |
| Incidents on record | 1 (worst: low) | 2 (worst: high) |
| Where release notes are published | Public changelog/releases on GitHub | Release notes on vendor support site |
| Trezor Safe 3 at Trezor | Ledger Nano S Plus at Ledger |
"Security-flagged" means the vendor's notes mention a vulnerability, CVE, security fix or hardening. More flagged releases can mean more issues, or simply more transparent notes, so read the linked notes before drawing conclusions.
Security incidents for either device
- low Voltage glitch bypasses Trezor Safe 3 authenticity/firmware check · Mar 12, 2025Ledger Donjon showed that the Safe 3's microcontroller can be voltage-glitched to bypass its firmware-integrity and authenticity check. It needs full physical access and repackaging; Trezor says private keys and PIN cannot be extracted this way and that Safe 5 is not affected.
- high Ledger Connect Kit supply-chain attack (web library, not devices) · Dec 14, 2023An attacker phished a former Ledger employee's NPM account and published malicious Ledger Connect Kit versions 1.1.5 to 1.1.7, which drained funds from users signing transactions on affected web dApps. Ledger says devices and Ledger Live were not affected; fixed version 1.1.8 shipped the same day.
- high Ledger e-commerce and marketing database breach (customer data, ongoing phishing) · Jul 29, 2020Ledger disclosed that its e-commerce and marketing database was breached, exposing customer contact details. Devices and funds were not compromised, but the leaked data still fuels phishing emails, texts and fake 'replacement device' mail.