Tropic Square develops TROPIC01, a security chip designed to protect sensitive data and perform cryptographic operations. The company designs chips but has no fabrication plant of its own. By publishing design materials and documentation, it aims to enable independent security research. The chip itself is not a wallet, and openness does not guarantee that a complete device cannot be attacked.
Hold a hardware wallet and you see its case, screen and buttons. Inside, different components perform different jobs. Tropic Square develops the TROPIC01 security chip; another company builds the finished wallet around it. Tropic Square is a fabless company: it designs chips and has their physical manufacture carried out elsewhere. On 6 October 2025, it announced full production and worldwide distribution. That was a manufacturing milestone, not a permanent promise that every variant would always be in stock. [1]
A maker calling a component secure is not enough for a specialist who wants to test its behaviour. That requires technical materials. The TROPIC01 repository provides RTL, a source description of the logic circuits, firmware, meaning the chip’s software, and its security architecture. It describes a RISC-V core that executes instructions and SPECT, a specialised coprocessor for cryptographic calculations. Publishing this material makes examination possible; publication alone is not the result of a successful security audit. [2]
Imagine a researcher examining the chip in a specific device. The documentation must correspond to that component and its firmware. On GitHub, Tropic Square warns that public repositories may not exactly match shipped products: publication can lag, and third-party rights restrict some materials. Openness is therefore more than a label for the whole product. A meaningful assessment connects the chip’s part number, software version and relevant documentation. [3]
Between an online design and a component in a box come manufacturing and device preparation. The EPS Global partnership announced in February 2025 covers secure programming, initial chip provisioning and distribution. It includes PKI, or public key infrastructure: cryptographic credentials and checks that help authenticate a chip. This addresses where a component comes from. It does not, by itself, establish that its design is flawless or that a wallet maker integrated it correctly. [4]
Behind the technical documentation are people whose responsibilities change. On 12 May 2026, Tropic Square announced that co-founder Jan Pleskač was stepping down as CEO, or chief executive officer, while remaining a shareholder. Ladislav Veselý was to take over on an interim basis. Owning a stake and running daily operations are different roles. An older interview introducing Pleskač as chief executive belongs to that period; it does not establish the present leadership without further checking. [5]
On 3 June 2026, the company described a finding by Ledger Donjon: laser fault injection, a technique that induces faults with a laser, could bypass TROPIC01 firmware verification. Firmware is the program whose authenticity the chip is supposed to check before running it. The attack required physical access to the chip, expertise and a specialised laboratory; it was not an ordinary remote attack over the internet. The disclosure recommended disabling maintenance mode. That makes an attack harder but does not eliminate it. Reducing risk and removing a vulnerability are different outcomes. [6]
The impact also depends on the device incorporating the chip. Trezor explains that, in Trezor Safe 7, TROPIC01 protects part of the secret material used to safeguard the PIN, the personal access code. According to the manufacturer, neither the PIN itself nor the wallet backup is stored on this chip, and other protective layers remain involved. An attack on a component therefore does not automatically establish a compromise of the complete wallet. Nor do additional layers make the device invulnerable. [7]
Tropic Square describes CVD, coordinated vulnerability disclosure: researchers and the manufacturer work on verifying a problem, addressing it and informing the public. Alongside security advisories, it publishes errata, meaning lists of known defects and limitations, and evaluation reports. Its chip research policy does not replace the rules of the manufacturer using the chip in a device. For readers, the practical approach is to follow the particular version, disclosed finding and remedy actually available. Those details give openness substance. [8]
For the clearest picture, read this entry together with Jan Pleskač, TROPIC01, SatoshiLabs, Secure Element. The reverse links also lead from Trezor, Marek “Slush” Palatinus, Secure Element, Jan Pleskač.