A Trezor Safe 7 went through the laundry. Its owner had no recovery seed backup, so a replacement device was useless to them: the only copy of the wallet lived on the water-damaged board. I opened the Safe 7, removed its original mainboard, transplanted that board into a new donor Safe 7, and reassembled it into a device that powers on and boots to its lock screen.
The teardown, board transplant, and reassembly all succeeded. Wallet access was not recovered. The board survived the move; the wallet still sits behind its PIN and the secure elements that guard it. Everything below is a photographic record of the hardware work, not a service procedure.
To my knowledge, this is the first publicly documented Trezor Safe 7 teardown, mainboard transplant, and reassembly by anyone outside SatoshiLabs.
Why open a water-damaged Trezor Safe 7 at all
Locked out of a wallet like this one?
I repair hardware wallets, crack forgotten passwords, and rebuild broken seed phrases — on my own bench in Denver.
Trezor's answer to a dead device is simple: buy a new one and restore from your recovery seed. That answer fails the moment the seed is missing. A Safe 7 with no backup is the wallet, and the wallet is on one small board.
The Safe 7's security design is three layers deep: a main microcontroller working with two secure elements, TROPIC01 and OPTIGA Trust M (Trezor's own description of the three hardware layers). Nothing about that design is defeated by moving the whole board from one enclosure to another. The point of a transplant is the opposite: keep the secrets exactly where they are, and replace everything around them that water may have ruined, including the display, the touch layer, the battery, and the sealed housing.
Opening the Safe 7 enclosure
The Safe 7 is a sealed, adhesive-bonded aluminium device with no service cover and no visible screws. All access is through the front glass; the rear panel was never removed. It opens the way a modern phone opens: heat to soften the adhesive under the glass, a suction handle to lift it, and thin plastic cards worked around the perimeter.
Heat was the variable I watched most closely, because the battery sits directly beneath the glass. I used an iFixit iOpener heat pack and a heat gun, and checked every step with an infrared thermometer. The iOpener surface measured 174 to 187 F (79 to 86 C). The device face itself was held to 111 to 124 F (44 to 51 C), with a session maximum of 123.8 F. That is warm enough to let the adhesive give with steady pull from the suction handle, and well short of anything that risks the lithium polymer cell.
The reason this needs care rather than force: the battery fills most of the enclosure directly beneath the glass, and the display connects through a short flex cable. Either one can be destroyed by an opening card that goes a few millimetres too deep. That is the difference between a water-damaged Safe 7 and a water-damaged Safe 7 with a punctured battery and a torn screen.
Under the display
Once the adhesive releases, the display hinges up from the frame and the interior is visible for the first time. The display does not come free yet: its flex cable still bridges the gap to the mainboard.
Inside the Safe 7: battery and TS7 mainboard
With the display folded out of the way, the layout is straightforward. The battery occupies most of the enclosure. The mainboard is a compact board at the narrow end of the enclosure, carrying the USB-C port, marked TS7 rev.D on the unit photographed here. The display flex folds back over the board to reach its connector.
The board revision is worth noting because it is the only one I have photographed. Other Safe 7 units may differ inside, and nothing here should be read as a promise about every device.
Markings visible on this unit, for anyone searching a part number:
- Mainboard: TS7 rev.D, retained by small screws at its corners, with the USB-C port and the display connector on the board edge
- Battery: JYH lithium polymer pouch, PFL333838-350 1S1P, 3.2 V, 350 mAh, 1.12 Wh, P/N 0B23-04CQ000
- Display panel: LX250106C-V7 with glass marked ZD250GL1868-V2-08
- Display flex: FPC-2502401, date code 20241122; connector flex ZD250F1868 V4
The opening photograph shows the next stage: display detached and the mainboard lifted out of the enclosure entirely, with the battery still seated. That bare board, and the two secure elements on it, is what the transplant is about.
Mainboard transplant and reassembly
The original board went into a new Safe 7 donor unit, with the donor's display, battery, and enclosure taking over from the laundered parts. Before closing anything, the board was powered over USB-C on the bench with a display attached, to confirm it still booted, drove the screen, and accepted touch input.
What this proves, and what it does not
What the work established:
- A Trezor Safe 7 can be opened without destroying the display, the battery, or the mainboard.
- The mainboard can be removed intact and moved into another Safe 7.
- The transplanted board boots, drives the display, and reaches its lock screen in the new housing.
What it did not establish:
- Wallet access. The wallet is still protected by its PIN and secure elements, exactly as it was before the laundry. Reaching a PIN prompt is a hardware milestone, not a recovery.
- A signed transaction from the affected wallet.
- Whether reassembly restored the enclosure's original water resistance. Assume it did not.
That honesty matters in this field. Plenty of "recovery" operators will describe a photo like the one above as a success. It is a successful repair of a device. Whether it becomes a successful recovery of funds depends on the owner's PIN, and no amount of bench work changes that.
Trezor Safe 7 repair questions this work answers
Can a water-damaged Trezor Safe 7 be repaired? Sometimes. If the mainboard survived, everything around it (display, touch layer, battery, housing) can be replaced with donor parts, as this article shows. If the board itself is corroded or shorted, board-level work is a separate and much harder question.
Can the Safe 7 screen or battery be replaced? Physically, yes: both are separate parts connected to the mainboard, and both were swapped here. A donor device is the practical source of parts.
Does opening a Safe 7 expose the recovery seed? No. The seed lives inside the secure elements on the board. Opening the case gives you the board; it does not give you what is on it.
Is this something to try at home? A Safe 7 with no backup is a one-of-a-kind object. If it matters, it is not the device to learn on.
Related reading
My earlier Trezor Model T touchscreen-swap article covers a different enclosure and display design; the Safe 7 needed its own account rather than instructions copied from the older model.
If your concern is access to a wallet rather than its construction, start with Trezor recovery: lost PIN, wiped device, or broken hardware. For an assessment of a damaged device, see Trezor recovery and repair. Describe the damage and whether a backup exists; do not send your seed words through the contact form.