A user holds Ethereum and tokens on a Trezor hardware wallet but needs to interact with a decentralized exchange, lending protocol, or NFT marketplace. Opening MetaMask or another software wallet defeats the purpose of hardware security. The practical question becomes how to access DeFi applications without exposing private keys to an internet-connected browser extension or phone app.

Trezor Suite addresses this through a dapp browser that connects applications directly to the hardware device, keeping private keys offline while allowing transaction signing and wallet interaction. The separation between the web interface managing account data and the device controlling key material is the foundation of Trezor security. Understanding how to use dapp connectivity safely requires knowing which applications are supported, how to verify connection integrity, what each transaction confirmation shows on the device screen, and when to refuse a signature request.

The architecture: why dapp connectivity requires hardware confirmation

Traditional software wallets like MetaMask or Trust Wallet hold private keys in the device memory or a local encrypted file. When a dapp requests a transaction signature, the wallet signs it automatically or after a brief software confirmation. This is convenient but also exposes the signing capability to malware, browser exploits, or a compromised extension. A user who installs a malicious version could lose all connected funds without warning.

Trezor Suite separates this process. The hardware device holds the private keys and never shares them with the connected computer or phone. When a dapp requests a signature—whether to approve a token transfer, execute a swap, or mint an NFT—the Suite application sends the unsigned transaction to the device. The device displays the destination address, token amount, gas fees, and other critical parameters on its screen, which the user reviews physically. The user must press a button on the device to approve the signature. If the transaction details on the device screen do not match what the dapp claimed, the user can refuse.

This design means that trezor security depends on two independent verifications. First, the user must check that the dapp is legitimate before connecting. Second, the user must verify transaction details on the device screen before signing. No amount of software security can override a user who approves a malicious transaction, but the hardware requirement prevents silent approval or unsigned transactions from the dapp side.

The dapp browser itself is a web interface, typically accessed through suite.trezor.io/web or the desktop Suite application. This means it is internet-connected and subject to the same risks as any web browser. However, the dapp browser does not hold private keys. If an attacker compromises the web interface, they can try to trick the user into approving a bad transaction, but they cannot sign one without the device’s physical confirmation. This distinction—compromising the interface versus compromising the keys—is central to understanding how Trezor Suite dapp connectivity works.

Getting started: connecting Trezor Suite to Ethereum and Polygon dapps

Begin by updating Trezor Suite to the latest version and ensuring the hardware device firmware is also current. Visit the official trezor suite page or download directly from suite.trezor.io. Do not install from third-party sources or unknown URLs, as a modified version could simulate legitimate transactions while stealing signatures or recovery data. Open the desktop or web application, unlock the device with its PIN, and navigate to the Applications or dapps section.

In Trezor Suite, select the Ethereum or Polygon network from the coin selection menu. The Suite application will display the account associated with that network and its balance. At this point, the device is unlocked and ready to receive connection requests. Most dapps require the user to click a “Connect Wallet” button on the dapp interface itself. When prompted to choose a wallet, select “TrezorConnect” or the option that indicates hardware wallet support. The browser will display a connection dialog, and the Suite application should recognize it.

Do not approve a connection request on the Suite side if you did not initiate it. An attacker could attempt to create a connection from an unrelated browser tab or window, trying to use your Trezor device to approve transactions you did not authorize. The key principle is that you should only proceed when you actively visited the dapp and clicked the connection button yourself. Once connected, Trezor Suite will display the dapp in a dedicated browser window or tab within the application, and your Ethereum or Polygon address will appear in the dapp’s wallet selector.

From this point forward, any transaction initiated in the dapp—a swap, token approval, NFT purchase, or protocol interaction—will require a signature from the device. The dapp sends an unsigned transaction to Trezor Suite, which transmits it to the hardware device. The device screen shows the transaction details, and you press the button to approve or refuse. The signature is created on the device and returned to the dapp, which broadcasts it to the blockchain.

Reading transaction details on the device screen

The device screen displays different information depending on the transaction type. For a simple ETH transfer, you will see the recipient address, the amount in ETH or wei, and the gas fee. For a token transfer or approval, you will see the token contract address, the recipient or spender address, the token amount, and gas parameters. For a more complex DeFi transaction—such as a liquidity provision on Uniswap or a borrow-collateral interaction—the screen may show multiple items and require scrolling.

A critical habit is to verify the recipient address in full rather than checking only the first few characters. Address spoofing attacks rely on users noticing only the beginning of an address and assuming it matches. Trezor device screens are small and not ideal for reading 40-character Ethereum addresses, but this is exactly why the hardware requirement exists. If you are suspicious of any address, refuse the transaction and verify it independently before trying again.

Another common transaction type is a token approval. When a dapp requests permission to transfer a token on your behalf—such as when you are about to swap on a decentralized exchange—the device screen will display “Approve” and show the token contract, the spender (the dapp’s router contract), and the approval amount. Many dapps request “unlimited” approval to avoid requiring a new approval for each transaction. This is a trade-off: unlimited approval is convenient but means that if the spender contract is exploited, the attacker could drain your entire token balance without a new signature request. Consider requesting a finite approval amount or revoking previous unlimited approvals if you no longer use a service.

If the device screen shows something different from what you expected, or if you cannot read or understand a field, refuse the transaction. Do not press approve. Close the dapp tab, disconnect the wallet, and research the transaction or contact the project’s support. A legitimate service will not disappear if you take time to verify what you are approving. A service that pressures you to sign without understanding is a warning sign.

Coin control, transaction fees, and custom networks

Trezor Suite offers coin control for Bitcoin and some Ethereum-based tokens when using the wallet management interface directly. Coin control lets you choose which specific UTXOs (for Bitcoin) or token balances to send, rather than allowing the wallet to select automatically. This is most useful for privacy and for avoiding accidental consolidation of funds from different sources.

When using dapps through the browser, coin control depends on the dapp’s interface, not directly on Trezor Suite. However, you can still observe which address is being used and what balance is available. If the dapp is offering to swap or transfer from an account you did not intend to use, disconnect and reconnect with the correct account selected in Trezor Suite first.

Transaction fees in Ethereum and Polygon are shown on the device screen in both wei and the human-readable unit. The dapp sets the gas price and limit, but you can refuse if the fee appears excessive. Market conditions, network congestion, and the dapp’s configuration all affect fees. It is worth understanding that a lower fee may result in slower confirmation or failure if the network is congested, while a higher fee increases the cost but should confirm faster. The device screen gives you a chance to see this trade-off before signing.

Custom networks can also be added to Trezor Suite, though this requires caution. Adding a network to the Suite allows it to display balances and make transactions on that network, but it also means the Suite will attempt to connect dapps to it. Only add networks you trust and have verified independently. Adding a custom RPC endpoint that you do not control could allow an attacker to manipulate transaction displays or steal information about your addresses. Stick to official, well-known networks and endpoints unless you have a specific reason and have researched the risk.

Risks and limitations of dapp connectivity

The most important limitation is that Trezor Suite dapp browser is a web interface. It can display information incorrectly, be slow during high network congestion, or fail to update balances in real time. If you believe the interface is showing stale or incorrect data, refresh the page or wait before making another transaction. Network conditions can also cause connection drops between the Suite and the dapp, which may interrupt a transaction process. If a connection fails after you have approved a signature, check the blockchain explorer with your address to see whether the transaction actually broadcast. Do not simply retry; you may end up creating duplicate transactions.

Another limitation is that not all dapps work with Trezor hardware wallets. Some may require features that the Suite does not support, or they may not recognize the Trezor-Connect wallet option. Many popular services—Uniswap, Aave, Curve, OpenSea, and others—do support hardware wallet connectivity, but smaller or newer projects may not. If a dapp does not offer a hardware wallet connection option, you will need to use a software wallet instead, understanding that you are accepting the security trade-off.

Passphrase protection adds another layer to your Trezor security but introduces complexity when switching between dapps or accounts. If you have set a passphrase on your device, Trezor Suite will prompt you to enter it when you connect a wallet. Each different passphrase creates a different wallet and set of addresses. If you forget the passphrase, you cannot recover the accounts it protected—they exist only when the correct passphrase is entered. Store passphrase information safely but separately from your recovery seed.

Finally, remember that trezor security does not protect against all risks. A dapp may be genuinely malicious, designed to trick users into approving transactions that appear legitimate on the device screen but have unintended consequences. For example, approving a contract that looks like a swap but actually attempts to transfer your entire wallet to a different address. The device shows you what is on the blockchain level, but it cannot always show you the human-readable intent. Research unfamiliar protocols, read documentation, and proceed cautiously with high-value transactions.

Best practices for safe dapp interaction with Trezor Suite

Start with small amounts when testing a new dapp or service. Send a small token amount, approve a test transaction, or interact with the service on a testnet first if available. This limits your loss if something goes wrong and gives you a chance to see how the dapp and Suite interact before risking significant funds.

Verify that the dapp URL matches the official project website. Phishing sites often have URLs that look similar but are slightly different—for example, “uniswap-app.com” instead of “uniswap.org.” Bookmark the official dapp URL or navigate to it through a project’s social media and documentation, never through search results alone. When the dapp loads, it should show a wallet connection button or prompt. Click that button and select the hardware wallet option from the list.

Keep your Trezor device firmware and the Trezor Suite software up to date. Updates patch security issues and add support for new protocols and networks. However, do not automatically update the firmware immediately when a new version is released. Wait a few days to ensure that the update has been tested by the community and does not introduce compatibility issues. Check the Trezor blog and community forums for any reported problems before updating.

Use a separate browser profile or window for dapp interaction if possible. This reduces the risk that a malicious script running in another tab or extension can interfere with your dapp session. Modern browsers support multiple profiles or private browsing modes; using one dedicated to crypto transactions can be a practical improvement without much overhead.

Do not allow dapps to store your recovery seed or any private key material. If a service asks you to enter your recovery seed or private key at any point—whether in the Suite, on a website, or in an app—stop immediately. This is a phishing or theft attempt. Your private keys should never be entered into software. The only legitimate time to use your recovery seed is to restore your wallet on a new or replacement device during a formal recovery process.

Polygon, Ethereum Layer 2s, and multi-chain complexity

Trezor Suite supports Polygon (formerly Matic) and other Ethereum-compatible networks. Polygon shares Ethereum’s address format but is a separate blockchain with its own gas fees, token contracts, and ecosystem. When using Trezor Suite with Polygon dapps, the process is identical to Ethereum: select Polygon from the network menu, connect to the dapp, and confirm transactions on the device.

The key operational difference is that Polygon and Ethereum are separate networks with different bridges and exchanges for moving assets between them. A token address on Ethereum is not the same as the Polygon version, even if it has the same name and symbol. If you intend to swap tokens between networks, use a proper bridge like Polymarket or the official bridge, not a dapp that claims to trade between networks directly. Legitimate bridges are transparent about their mechanism and reserve holdings.

Trezor Suite also supports Ethereum Layer 2 solutions through custom network configurations. Adding an L2 network—such as Arbitrum or Optimism—requires you to add the network’s RPC endpoint. Once added, you can use dapps on that Layer 2 the same way as Ethereum or Polygon. However, Layer 2s have their own token economics, bridge mechanics, and security models. Understand that moving funds from Ethereum to a Layer 2 requires a bridge transaction, which typically takes time and may have withdrawal delays for moving back to Ethereum. Research the Layer 2’s documentation and the bridge mechanics before transferring significant amounts.

Troubleshooting connection issues and transaction failures

If Trezor Suite cannot connect to a dapp, first verify that the device is unlocked and that the correct network is selected in the Suite. Refresh the dapp page and try connecting again. If the problem persists, check that your internet connection is working by visiting a non-crypto website. Network timeouts or DNS issues can prevent the dapp from loading or communicating with the Suite.

If the dapp shows a zero balance even though you know you have funds, the issue may be with the RPC endpoint or node connectivity. The Suite uses Trezor’s default node providers, but these can occasionally be slow or unavailable. Try disconnecting and reconnecting the wallet, or restart the Suite application. If the balance still does not update, check a public block explorer like Etherscan to verify your actual on-chain balance.

If a transaction appears to be stuck—you approved it on the device but it has not broadcast or confirmed after several minutes—check the blockchain explorer with your address and look for the transaction hash. If the transaction is there but showing a status like “pending” or with low gas, it may be queued. If it is not there, the broadcast may have failed silently. Try refreshing the dapp or checking the Suite’s transaction history to see if it shows a record of the attempt. Do not resubmit the same transaction unless you are certain the first one failed.

Connection drops between Suite and the device are rare but can happen if the USB cable is loose, the device is unplugged, or the computer is in sleep mode. Always keep the device connected during a dapp session and avoid moving it or the computer until the transaction is fully confirmed on-chain. If you must stop mid-transaction, disconnect the wallet, unplug the device, and resume only when you are certain you can complete the process without interruption.