A user holds a legitimate ERC-20 token from a specialized DeFi protocol, a staking reward in an obscure network asset, or an NFT from a smaller creator. These tokens may have real value and genuine utility, but Trezor Suite does not display them by default. The question then becomes practical: how does a user safely add a token that the Trezor developers have not pre-loaded into the interface? The answer involves understanding why tokens are not automatically listed, how to locate accurate contract information, and what verification steps prevent mistakes that could result in lost funds or compromised security.
Trezor Suite’s architecture separates software from hardware for a reason. The desktop, web, or mobile application runs on an internet-connected device and communicates with a Trezor hardware wallet that never exposes private keys. When a user adds a token, they are not adding it to the device itself but to the software interface’s tracking list. This distinction matters because it means the hardware wallet does not need to know about every token; the software simply needs accurate contract addresses and network information to generate the correct transaction data. A user can manage cryptocurrency across multiple interfaces, but only the Trezor device can authorize the actual spending or movement of funds.
Why Trezor Suite does not list every token
Trezor Suite maintains a curated list of tokens for several practical reasons. The first is attack surface reduction. A comprehensive database requires ongoing maintenance, verification, and updates. Each entry is a potential point of error—a typo in a contract address, misleading metadata, or a token that has been replaced or migrated. Rather than expose users to the risk of selecting a fraudulent duplicate from a massive list, Trezor defaults to a smaller set of well-established assets that the team has verified.
The second reason is user experience. Too many options, especially when most users never interact with them, creates confusion. A user searching for “USDT” should not face twenty results without knowing which one is correct. By pre-loading the most commonly used tokens on each network—Ethereum’s USDC, USDT, DAI, and major layer-2 assets—Trezor Suite reduces the cognitive burden while still supporting the transactions most users actually perform.
The third reason is security responsibility. Trezor’s developers cannot audit every token’s smart contract code or guarantee that a token’s metadata is accurate. By maintaining a smaller verified list, they reduce the likelihood that a user will accidentally send funds to a scam contract, approve a malicious token, or approve an unlimited spend allowance to an address that is not what it appears to be. A user adding a custom token accepts responsibility for verifying that token’s legitimacy.
This design principle extends to NFTs and other non-fungible assets. While Trezor Suite can display and manage NFTs held in a wallet, the software does not automatically list every collection. Users must verify the collection contract address and network before importing. This friction is intentional. A token that is easy to add is also easy to add incorrectly, and mistakes in the blockchain space are often permanent.
Locating accurate token contract information
Before adding a token to Trezor Suite, a user must obtain the correct contract address. This is not optional; using the wrong address will result in the token not appearing in the wallet even if the user believes they hold it. The recommended source is a block explorer such as Etherscan for Ethereum, Polygonscan for Polygon, or network-specific explorers. Starting from the official project website or application is a safer approach than searching for the token name directly.
The workflow should follow this sequence. First, visit the official project website and locate the token or governance documentation. Look for an explicit statement of the contract address, often labeled as “contract address” or “token address.” Second, copy that address and paste it into the appropriate block explorer. Third, verify that the explorer shows the correct token name, symbol, and decimal count. Fourth, cross-reference this information against multiple sources if the token is important or high-value. The additional time spent here can prevent costly mistakes.
Block explorers display useful validation information. A verified contract should show the source code, creator, creation date, and total supply. If a contract’s source code is not available or the listed holder count seems inconsistent with a project’s claims, investigate further. Some legitimate tokens do not publish source code, but that choice should prompt additional verification from alternative sources. If multiple independent sources confirm the contract address, symbol, and decimal count, the token is more likely to be correct.
A common error is confusing similar token names. Scammers frequently create tokens with names nearly identical to popular assets. Ethereum holds multiple contracts for “USDT” because the genuine Tether USD token exists alongside various wrapper or bridged versions. The contract address is the authoritative identifier; the name and symbol are metadata that can be faked. Never add a token based solely on matching a name. The contract address must be independently verified as belonging to the project you intend to use.
Adding a custom token in Trezor Suite
The process of adding a token differs slightly depending on whether the user is working within Ethereum and EVM-compatible networks or other asset types. For Ethereum and similar networks, the steps are straightforward once the contract address and network are confirmed. Open Trezor Suite, navigate to the account where the token should appear, and select the option to add a custom token. The interface will prompt for the contract address, which the software will use to query the network for token metadata.
Trezor Suite will attempt to retrieve the token’s name, symbol, and decimal precision automatically by examining the contract’s public functions. If this lookup succeeds, the user should verify that the retrieved information matches independent sources. If the lookup fails, the user must manually enter the token name, symbol, and decimal count. This manual entry is where errors most often occur. Entering the wrong decimal count, for instance, will display incorrect balances or cause transactions to fail silently. A token with 18 decimals (standard for many ERC-20 tokens) is not the same as one with 6 or 8 decimals.
After entering or confirming the token details, the user should see the token appear in their account’s token list. The wallet will now display the balance of that token, assuming the user holds any. Most importantly, the user can now send or receive this token using Trezor Suite’s interface. Transactions still require physical confirmation on the hardware wallet, maintaining the same security model as any other transaction. The Trezor device does not need to “know” about the token; it only needs to understand the underlying transaction structure and confirm that the user is signing the correct destination and amount.
For tokens on non-Ethereum networks, the process is similar but may require additional configuration. If the user is adding a token on Polygon, Arbitrum, Optimism, or another EVM-compatible chain, the network must be selected before adding the token. Trezor Suite supports multiple networks, but the user must have explicitly enabled that network in the settings. Once enabled, the token addition process follows the same pattern: verify the contract address, allow the software to retrieve metadata, and confirm the details.
Verifying token details and preventing common mistakes
A critical verification step that many users skip is confirming the token’s decimal count through multiple methods. The decimal count determines how the blockchain represents fractional amounts. A token with 18 decimals treats 1 unit as 1,000,000,000,000,000,000 in the underlying smart contract. If Trezor Suite retrieves a decimal count of 6 when the correct count is 18, all displayed balances will be incorrect by twelve orders of magnitude. This is not merely a display issue; it can affect how the wallet suggests gas prices, calculates amounts for transactions, and displays portfolio values.
Another verification step involves checking the token’s total supply and distribution. If a token claims to have a supply of 100 million units but the block explorer shows a different number, investigate. Some tokens implement burn mechanisms or permit ongoing minting, which can change the supply over time. Understanding whether a token’s supply is fixed, expanding, or managed through governance helps assess whether the token you intend to add is the original or a clone created to deceive users.
Bridge tokens and wrapped versions introduce a particular category of confusion. An Ethereum user holding Polygon-wrapped Ethereum (wETH on Polygon) is not holding actual Ethereum; they hold a representation of Ethereum locked on the Polygon network. The contract address for wETH on Polygon is entirely different from Ethereum’s address on Ethereum. If a user is adding a wrapped or bridged version of an asset, they must explicitly add the correct contract address for that network. Confusing these addresses will result in visible confusion: a wallet may show two separate token entries when the user intended to track only one asset across multiple networks.
Passphrase protection adds another dimension to token management. If a user has enabled a passphrase on their Trezor device, different passphrases will generate different accounts and wallet addresses. A token added to the wallet under one passphrase will not appear when using a different passphrase. This is intentional security architecture, but it can cause confusion if a user forgets which passphrase corresponds to which set of accounts. Adding custom tokens should be done only after the user has confirmed which passphrase they intend to use for that account.
Using Trezor Suite’s built-in verification and metadata sources
Trezor Suite improves token verification by querying multiple sources for contract metadata. When a user adds a custom token, the software does not rely on a single registry. Instead, it examines the contract itself and cross-references information from on-chain sources. This approach is more resilient to fraudulent or outdated information than a centralized token list would be. However, this verification is only as good as the sources Trezor Suite queries and the accuracy of the on-chain data.
The software also maintains a list of known scam tokens or contracts that have been flagged for abuse. If a user attempts to add a contract that has been identified as potentially malicious, Trezor Suite may display a warning. These warnings are not foolproof, but they provide an additional checkpoint. A user should take any warning seriously rather than dismiss it as a false positive. If Trezor Suite warns about a token, the user should pause, independently verify the contract, and understand why the warning appeared before proceeding.
For tokens that have been verified and included in Trezor Suite’s default list, the software handles all of this automatically. Users do not need to verify contract addresses for USDC, DAI, or other established tokens. The security advantage of a curated list is that Trezor’s developers have already performed this verification work. As covered in this article, the tradeoff between convenience and comprehensive token coverage is intentional. Pre-verification reduces user error at the cost of not supporting every emerging token immediately.
Managing tokens on mobile and web versions of Trezor Suite
Trezor Suite is available across desktop, mobile, and web platforms, and the token addition process is consistent across all versions. A user can add a custom token using the desktop application, and that token will appear in the Trezor Suite web interface and mobile apps when accessing the same wallet and account. The Trezor device itself stores only the private keys; token metadata is stored in the software interface and can be consistent across all platforms if the same wallet seed and passphrase are used.
Mobile versions present a practical consideration: screen size and interface design may require simplified workflows. Trezor Suite’s mobile application includes token management, but the process may be condensed compared to the desktop version. Users adding tokens on mobile should follow the same verification steps as on desktop. The reduced screen space does not change the importance of confirming contract addresses or decimal counts. Copy-pasting or manually entering long contract addresses on a phone screen is also more error-prone, so users managing important tokens may prefer to add them on desktop first.
The web version of Trezor Suite requires a Chromium-based browser and connection to the Trezor Bridge or hardware wallet via USB. The web interface provides the same token management capabilities as the desktop version. Importantly, the web version does not store any keys or sensitive data locally; it communicates directly with the hardware wallet. Token metadata is retrieved from the network each time, reducing the risk of stale or incorrect information. However, users should always verify that they are accessing the legitimate Trezor Suite website and not a phishing replica.
Handling token migration, rebranding, and contract updates
Tokens sometimes undergo migrations, rebrandings, or contract replacements. A project may deploy a new version of their token and ask holders to migrate from the old contract to the new one. Trezor Suite will not automatically remove the old token or add the new one. The user must manually add the new contract address if they wish to track the updated token. After migration, the old token may become worthless, but it will remain listed in the wallet unless the user removes it.
To remove a token that is no longer needed, most users can simply delete it from their token list within Trezor Suite. This does not affect the underlying blockchain or the actual tokens held on the contract. It only changes what Trezor Suite displays. If a user mistakenly deletes a token they actually hold, they can re-add it by entering the contract address again. The tokens themselves remain on the blockchain and are still controlled by the wallet’s private keys.
Contract updates or security upgrades by token projects can also require user attention. If a token project publishes a new contract address for a security reason or to improve functionality, users may need to migrate their holdings to the new contract. Trezor Suite cannot automate this process; the user must initiate a transaction to send their tokens from the old contract address to the new one. This is where the security benefit of hardware wallets becomes important. The physical confirmation step ensures that the user is consciously approving the migration rather than accidentally transferring tokens to a scammer’s address due to a phishing email or compromised website.
When to seek additional verification or professional guidance
For tokens with high value, tokens from lesser-known projects, or cases where the user is uncertain about legitimacy, seeking additional verification is reasonable. Online communities, cryptocurrency forums, and social media channels associated with the project can provide information. However, users should be aware that these channels can also be infiltrated with scammers. A question posed on an official project Discord or Reddit community is more reliable than a random Tweet claiming to be from the project.
Professional services and blockchain analysis tools exist for users who need to verify token legitimacy at scale or for institutional purposes. These tools examine contract code, token distribution, trading patterns, and known scam registries. For individual users managing personal wallets, the combination of block explorer verification, official project documentation, and community confirmation is usually sufficient. The Trezor device itself does not require the user to be an expert in smart contracts or token verification; it only requires the user to take time confirming that the contract address is correct before signing a transaction.
If a user is completely uncertain about whether a token is legitimate, the safest approach is not to add it until they have obtained sufficient information. Missing out on an emerging token is a smaller risk than holding a fraudulent or malicious token. Once a token is added and transactions occur, reversing mistakes becomes difficult or impossible. The hardware wallet’s requirement for physical confirmation protects against many forms of attack, but it cannot protect against a user’s own decision to add an incorrect or malicious token based on incomplete information.
Frequently asked questions
How do I add a token that is not on Trezor Suite’s default list?
Navigate to your account in Trezor Suite, select the option to add a custom token, and enter the correct contract address for the network where the token exists. Trezor Suite will attempt to retrieve the token’s name, symbol, and decimal count automatically. Verify this information against independent sources such as block explorers before confirming. The token will then appear in your account’s token list if the address is correct.
Why does Trezor Suite not include every cryptocurrency token?
Trezor maintains a curated list to reduce attack surface, prevent confusion, and minimize the risk of users accidentally selecting a fraudulent or duplicate token. With thousands of tokens in existence, many with similar names, a smaller verified list is more secure than comprehensive coverage. Users can always add custom tokens, but doing so requires the user to verify the contract address independently.
What information do I need to verify before adding a custom token?
You need the correct contract address for the specific network where the token exists, along with confirmation of the token’s name, symbol, and decimal count. Verify this information through official project sources and block explorers such as Etherscan or Polygonscan. Never add a token based on a name match alone; the contract address is the authoritative identifier. Confirm decimal count with particular care, as an incorrect decimal count will result in incorrect balance displays.