Trezor Raises Passphrase Limit to 128 Characters After Coldcard’s $100M Wallet Thefts

Hardware wallet maker Trezor has increased the maximum length of optional wallet passphrases from 50 to 128 characters. According to Cointelegraph, the expanded limit is available through Trezor Suite when users install updated device firmware. Devices running older firmware remain limited to 50-character passphrases. Trezor describes a passphrase as an additional password that users create alongside a wallet’s recovery phrase. If an attacker obtains the recovery phrase, the passphrase provides another barrier to accessing funds held in the wallet. Trezor pointed to the Coldcard attacks in July as a reason for the importance of strong passphrases. A firmware flaw caused some Coldcard devices to generate recovery phrases with insufficient randomness, allowing attackers to reconstruct them. Trezor said strong, unique passphrases protected some users affected by those attacks. The passphrase limit change follows the Coldcard wallet thefts cited in the headline, while the company’s guidance also emphasizes keeping passphrases both strong and unique. The update comes amid a separate security concern involving Trezor devices. On Friday, the company advised customers who had bought wallets from former authorized reseller CryptoBilis since March to transfer their funds to new wallets. The advice followed an Indonesian customer’s report of a suspected implant inside a Trezor Safe 5. The customer said the device could capture information displayed on its screen, including recovery phrases, and transmit that data over a cellular network. Trezor said Friday that it had not examined the device and had received no reports of related losses. The company’s warning concerned wallets purchased through the former reseller during the specified period, while its passphrase update applies to users running updated firmware through Trezor Suite. Trezor’s guidance on the suspected device issue and its expanded passphrase limit address separate concerns: the first relates to a reported hardware implant, while the second increases the maximum length available for an additional wallet password.