Can anyone confirm Trezor's 2.12.4 firmware update is safe?

[Johnds1]

Since it's open source, which is one of the reasons I switched to Trezor, can anyone confirm the update is safe?  Was it verified?

Right now i still have 2.12.0 and it wants to update to 2.12.4

[PX-Z]

Since it's open source, which is one of the reasons I switched to Trezor, can anyone confirm the update is safe?  Was it verified?

Right now i still have 2.12.0 and it wants to update to 2.12.4

In the normal open source development sense, yes.

But does that mean it is "verified and safe"? No software can honestly be described as absolutely verified safe, though. Also, open source doesn't automatically mean safe. Someone still has to review the code, and reviewers can miss things.

[Charles-Tim]

I think what you should avoid are the phishing messages or going to the wrong site for the firmware update. You are safe as long as the update is done through the official website or through the right GitHub link.

https://trezor.io/other/product-updates/trezor-firmware-changelog-all-versions-and-release-dates

It is better you update it than to be using the old version.

No one is complaining about the update since August 19, 2026 which was 4 days ago.

[OmegaStarScream]

As mentioned above, given that the release date was 4 days ago, and there have been no reports of malicious activity, it's probably safe to use.

The code itself also seems to have been pushed a few weeks ago: https://github.com/trezor/trezor-firmware/releases/tag/core%2Fv2.12.4

Unless Trezor has stated otherwise, it's probably safe to continue using the version you're currently using anyway;

[BitMaxz]

There's no software to fully verify and check if the latest firmware update is safe. The only way to know if it is safe is if you manually check the source code from their GitHub page, which is provided above.

You can download that firmware from GitHub and then flash the device via install custom firmware under the danger area. If you trust Github, than just clicking update from Trezor suite then review the open-source code from Github to verify if it is safe or not.

To me, even with any device I have in my house, usually I don't update the firmware for almost a week or two at least to make sure no one is reporting any issue about the firmware.
Just like Antminer units, sometimes it gets corrupted and has some issues after flashing firmware. That is why I always wait for a few weeks or until at least the current unit is having software issues; that is the time for me to update the unit.

Do this the same in your Trezor, but if your current firmware reported vulnerabilities, better update it immediately.

[X-ray]

Depends on what you mean by "safe", any release build already passed automated test, otherwise it won't pass.  So, it's safe from the developers perspective.

Since it's open source. If there is an issue found by the community someone would've raised the issue or reported it.

But whether it's truly safe or not, nobody knows.

Probably somebody have looked at the diff and found nothing of concern.

[Yamane_Keto]

It is best not to perform any update unless it is necessary or to fix a security vulnerability. It is best to wait a week or 10 days before downloading to ensure that a sufficient number of downloads have been made and that there are no complaints. This way you reduce the risks to a minimum.

[Lucius]

I think what you should avoid are the phishing messages or going to the wrong site for the firmware update. You are safe as long as the update is done through the official website or through the right GitHub link.
~snip~

Trezor firmware and software are upgraded directly through Trezor Suite and unless someone has fake ones I don't see why you mention their website or github link as possible options? I don't know if there is any other way to update the firmware, but as far as I know, an SD card is not used for that purpose.

[Mia Chloe]

As mentioned above, given that the release date was 4 days ago, and there have been no reports of malicious activity, it's probably safe to use.

I think this is an opportunity for me to get a general opinion on how long is relatively ok to wait before making updates. Sometimes it takes more than a couple of days before vulnerabilities eventually get discovered. This is not just a topic for hard ware wallets but also software wallets too.

For hardware most issues seem to come from when you generate your seed on the device with a weak firmware.

It is best not to perform any update unless it is necessary or to fix a security vulnerability. It is best to wait a week or 10 days before downloading to ensure that a sufficient number of downloads have been made and that there are no complaints. This way you reduce the risks to a minimum.

I think this might just work too . You can't be overly careful for things like these.

[dkbit98]

All Trezor updates can be checked ans verified on their github or official website page, but if you received update notification in Trezor Suite app, than it is safe to update.
Updates can be both for app update and for firmare update, but you can also use trezor with thirds party wallets.