Coldcard vs Trezor: Which Hardware Wallet for Cold Storage?

A hardware wallet does one job: it keeps your Bitcoin keys off your internet-connected computer, so malware on your laptop can’t sign away your coins.

Trezor and Coldcard both do that job well. They disagree about almost everything else… starting with how paranoid you should be.

The short version

Device	Who it’s for
Trezor	First hardware wallet, modest-to-serious stack, wants setup measured in minutes and documentation written for humans
Coldcard	Long-term cold storage of serious savings, Bitcoin-only by conviction, wants the keys to never touch an online machine

What they share

Both are paid devices that sign transactions inside the hardware, so your keys never sit on the computer where you browse the internet. Both publish their firmware for anyone to inspect, and both land at the same trust level on this site: trust-minimized rather than trustless, because you still rely on one vendor’s hardware and supply chain being honest. Trezor’s maker has carried that responsibility since it invented the category; Coinkite carries it for Coldcard. Both restore from standard seed words if the device breaks, and both sit at rung 2 of the sovereignty ladder alongside the other wallets in the directory.

The differences that matter

Threat model: cautious vs already-breached

Trezor’s model: your computer is probably fine, but keys shouldn’t live on it anyway. The device plugs in over USB, you confirm transactions on its screen, and the workflow stays close to normal software.

Coldcard’s model: your computer is already compromised, so plan accordingly. It can sign fully air-gapped — unsigned transaction out to a microSD card, signed transaction back — and the device never touches an online machine at all.

That second model sounds extreme until you price the downside. For a few hundred dollars of bitcoin, it is extreme. For savings you intend to hold a decade, it’s the appropriate level of distrust.

Bitcoin-only vs multi-coin

Coldcard runs Bitcoin and nothing else. Less code, fewer features, smaller attack surface, and a development team thinking about exactly one chain.

Trezor supports many coins, which makes it more useful to more people and gives its firmware more jobs to do. If bitcoin is all you hold, that breadth is weight you carry without benefit.

(Not a dealbreaker either way. A clean philosophical split, nothing more.)

Learning curve

Trezor is the gentle on-ramp, and that’s not faint praise: clear setup, readable docs, a workflow your less-technical spouse could follow if they ever had to recover the funds. That last scenario is worth weighing more than most comparisons do.

Coldcard is built for people who read the manual. (That’s a compliment, mostly.) The microSD workflow, the device’s many settings, the general assumption of competence… none of it is hostile, but none of it holds your hand either.

What you’re still trusting

Both publish firmware for inspection, but the openness differs in degree. Trezor’s firmware is open source in the full sense. Coldcard’s is source-viewable, published for verification, under a more restrictive license.

And with either device, the residual trust is physical: you assume the hardware that arrived in the mail is the hardware they built. Both vendors put real work into tamper-evident packaging and supply-chain checks, and neither can reduce that trust to zero. Nobody selling you a device can.

The honest pick logic

Pick Trezor for a first device, a modest stack, or any setup where someone other than you might need to operate it someday.

Pick Coldcard for deep cold storage: the savings you touch a few times a year, where air-gapped signing and Bitcoin-only firmware justify the steeper learning curve.

Pick neither if you’re holding a few hundred dollars. A free self-custodial hot wallet protects that honestly, and the self-custody starter path walks you through it; buy hardware when the balance justifies the device. And two alternatives are worth knowing: SeedSigner, a DIY signer built from roughly $50 of Raspberry Pi parts with no vendor to trust at all, and Foundation Passport, which splits the difference with air-gapped QR signing in a friendlier package.

My own uncertainty: I don’t think the air gap matters for most people as much as Coldcard’s marketing implies, because most coin loss comes from seed-phrase mistakes, not laptop malware. But “most people” is doing work in that sentence, and the user with life savings on the line isn’t most people.

Buy the device that matches your stack today. You can always graduate later; the seed words move with you.