Compare / COLDCARD Q vs Trezor Safe 7
COLDCARD Q vs Trezor Safe 7: firmware, security track record & price
A side-by-side look at how often each device gets updates, how many of those were security-related, and what each costs at the official store today. Numbers come from each maker's own release notes and store pages.
| COLDCARD Q | Trezor Safe 7 | |
|---|---|---|
| Official price | $319 | $249 |
| Current firmware | 1.5.3Q (Sep 30, 2026) | 2.13.0 (Oct 21, 2026) |
| Days since last update | 28 days | 7 days |
| Releases, last 12 months | 5 | 13 |
| Security-flagged releases, 12 mo | 2 | 7 |
| Incidents on record | 1 (worst: critical) | 1 (worst: low) |
| Where release notes are published | Public changelog/releases on GitHub | Public changelog/releases on GitHub |
| COLDCARD Q at Coinkite | Trezor Safe 7 at Trezor |
"Security-flagged" means the vendor's notes mention a vulnerability, CVE, security fix or hardening. More flagged releases can mean more issues, or simply more transparent notes, so read the linked notes before drawing conclusions.
Security incidents for either device
- critical COLDCARD firmware bug produced weak seeds; funds stolen · Jul 30, 2026Coinkite's advisory says COLDCARD firmware released from 2021 to July 2026 had a bug that produced poor entropy during seed generation. Attackers regenerated the affected private keys offline and stole funds; the devices themselves were not remotely accessed.
- low Laser fault injection on TROPIC01 secure element (Trezor Safe 7) · Jun 3, 2026Ledger Donjon showed that laser fault injection can bypass firmware signature checks on the TROPIC01 chip, one of the secure elements in the Trezor Safe 7. It needs physical possession, desoldering, decapsulation and lab equipment, and must be repeated on every power-up. Trezor says it does not expose the PIN or funds; Tropic Square rated it CVSS 5.7 (medium) and shipped firmware mitigations.