Trezor Safe 5 is VaultRubric's pick: it scores 92.0% vs Coldcard Mk4's 50.8% (a 41.2-point lead).
Data as of · Last updated · By VaultRubric Research · How we score · Not investment advice.
Trezor Safe 5 and Coldcard are both popular hardware wallets. Below: the sourced facts side by side, then VaultRubric's equal-weight score with the math shown, so you can see exactly why one comes out ahead. Every number links to its source and date; anything we couldn't verify says not found.
Run your own comparison →Opens the tool with these platforms filled in, so you can change the weights.
| Fact | Trezor Safe 5 | Coldcard |
|---|---|---|
| Price (USD) | not found | not found |
| Supported coins | 1,000+ 1,000+ (vendor count) src · 2026-10-10 | 1+ Bitcoin-only src · 2026-10-10 |
| Security incidents | 2024-01 Third-party support portal breach: names/emails of up to 66k support contacts; no seeds/funds src 2025-09 Trezor advisory / CVE-2025-69893: BIP-39 mnemonic processing side channel (physical access); affects Model One and Model T/Safe 3/Safe 5 on universal firmware with BIP-39 backup; fixed in firmware; no funds loss reported src · 2026-10-11 src · 2026-10-11 | 2026-07 Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement src · 2026-10-11 src · 2026-10-11 |
| Open source | not found | not found |
VaultRubric pick: Trezor Safe 5
⚠ Trezor Safe 5: data breach (2024-01)
⚠ Trezor Safe 5: firmware vulnerability (physical access only; informational, not scored) (2025-09)
⛔ Coldcard: customer funds hacked 2026-07 and not shown as fully reimbursed. Score capped at 60%, not eligible to be the pick.
| Criterion (weight) | Trezor Safe 5 | Coldcard |
|---|---|---|
| Price (17%) | 10.0/10 | not found |
| Security (17%) | 9.2/10 | 6.5/10 |
| Supported coins (17%) | 10.0/10 | 1.0/10 |
| Ease of use (17%) | 8.0/10 | 6.0/10 |
| Support (17%) | 9.0/10 customer reviews (Trustpilot), may skew positive | not found |
| Backup/recovery (17%) | 9.0/10 | 7.0/10 |
| Overall | 92.0% coverage 100% | 50.8% coverage 67% limited data |
0.167×10.0 + 0.167×9.2 + 0.167×10.0 + 0.167×8.0 + 0.167×9.0 + 0.167×9.0 = 9.20 → 92.0%0.167×5.0* + 0.167×6.5 + 0.167×1.0 + 0.167×6.0 + 0.167×5.0* + 0.167×7.0 = 5.08 → 50.8% (* unknown, imputed)From independent reviews; each point links to its source.
Opens the tool with these platforms filled in, so you can change the weights.
On VaultRubric's equal-weight rubric, Trezor Safe 5 scores higher (92.0% vs 50.8% for Trezor Safe 5 and Coldcard respectively). The better choice depends on what you weight most; run the tool with your own priorities.
No customer-funds hack is in our curated data. It does list: 2024-01: Third-party support portal breach: names/emails of up to 66k support contacts; no seeds/funds; 2025-09: Trezor advisory / CVE-2025-69893: BIP-39 mnemonic processing side channel (physical access); affects Model One and Model T/Safe 3/Safe 5 on universal firmware with BIP-39 backup; fixed in firmware; no funds loss reported.
Yes, our data records: 2026-07: Coldcard seed-generation flaw (software PRNG instead of hardware RNG on older firmware) let attackers brute-force seeds; ~$116M in BTC stolen (TRM Labs); fixed firmware since 2026-07-31 but affected seeds must be migrated; Coinkite has not offered reimbursement.
Each criterion gets 0–10 from cited evidence (curated dated data, live independent reviews, and AI analysis that must quote its source verbatim). Weights are normalized to 100%; missing data is scored at a conservative placeholder (5/10, or the comparison median if lower) so it can't lift a rank, and real-evidence share is shown as coverage. Under 75% coverage can't be the pick; within 3 points is Too close to call. Platforms with an unreimbursed customer-funds hack in the last 48 months are capped at 60% and can't be the pick. Fund-loss hacks deduct 3 security points; incidents where no customer funds were lost (data/email leaks, company-treasury losses) deduct only 0.5, half after 24 months and zero after 48. Criminal guilty pleas (−2) and major civil settlements (−1) in the last 5 years reduce the security score.