Trezor Raises Wallet Passphrase Limit to 128 Characters After Coldcard Attacks
Key Takeaways
- •The new 128-character passphrase limit is available only with updated Trezor device firmware.
- •Trezor said optional passphrases provide an additional barrier when a wallet recovery phrase is compromised.
- •July Coldcard attacks exploited insufficiently random recovery phrases and involved approximately $100 million in thefts.
- •Trezor advised customers who bought devices from former authorized reseller CryptoBilis since March to move funds to new wallets.
- •The CryptoBilis report concerned a suspected cellular-connected implant in a Trezor Safe 5, and Trezor said it had received no reports of related losses.
Hardware wallet manufacturer Trezor has raised the maximum length of its optional wallet passphrases from 50 to 128 characters, a move the company linked to July's Coldcard attacks, which involved roughly $100 million in wallet thefts.
Trezor announced the change on Sunday, detailing it in an official blog post covering the October 2026 Trezor Suite update. The longer passphrases are available when Trezor Suite is paired with updated device firmware, while wallets running older firmware remain capped at the previous 50-character limit.
Hardware wallets keep the private keys that control crypto funds offline. According to Trezor's documentation, a passphrase functions as an additional, custom password that users can set alongside their wallet's recovery phrase. Because the passphrase is required on top of the recovery phrase, an attacker who obtains the recovery phrase would still need to know the correct passphrase to access the funds held in that wallet. In that scenario the passphrase is the remaining barrier, and the higher character limit expands the set of possible passphrases an attacker would need to work through.
In announcing the update, Trezor pointed to the Coldcard attacks in July, when a firmware flaw caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to reconstruct them. The company said that strong, unique passphrases protected some of the affected users whose wallet recovery information had been compromised.
The passphrase increase follows a separate security warning involving Trezor's own devices. On Friday, the company advised customers who had purchased wallets from former authorized reseller CryptoBilis since March to move their funds to new wallets. The advisory came after an Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could capture on-screen information, including recovery phrases, and transmit it over a cellular network. Trezor said on Friday that it had not examined the device and had received no reports of related losses. The two episodes involved different vectors, a firmware randomness flaw in one case and a suspected supply-chain implant in the other, but both turned on recovery phrases reaching attackers, confirmed in the Coldcard case and suspected in the CryptoBilis report, which is the scenario Trezor's documentation describes a passphrase as guarding against.
Related: FBI blames North Korea for record $6.3B Binance hack.
