Trezor has raised the maximum length of optional wallet passphrases from 50 to 128 characters, citing the July Coldcard attacks where strong passphrases protected some users whose recovery information was compromised. Separately, the company advised customers who bought wallets from former authorised reseller CryptoBilis since March to move their funds. An Indonesian customer reported a suspected implant inside a device that could capture on-screen information and transmit it over a cellular network.
On Sunday, Trezor said the change is available in its Trezor Suite with updated device firmware; older firmware still limits passphrases to 50 characters. According to Trezor, a passphrase acts as an additional password that users set alongside their wallet's recovery phrase, so an attacker who obtains the recovery phrase would still need the correct passphrase to access funds.
The Coldcard attacks in July involved a firmware flaw that caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to reconstruct them.
On Friday, the company advised customers who bought wallets from former authorised reseller CryptoBilis since March to move their funds. An Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could capture on-screen information, including recovery phrases, and transmit it over a cellular network. Trezor said it had not examined the device and had received no reports of related losses.
Analysis
Why This Matters
- Hardware wallets are designed to secure cryptocurrency funds, and stronger passphrase length adds a layer of protection against seed-phrase theft.
- The Coldcard attacks showed that a firmware flaw could compromise recovery phrases, making an additional passphrase critical for users.
- The suspected implant highlights the risk of supply-chain tampering and the need for customers to verify the authenticity of their devices.
Background
Cryptocurrency hardware wallets store private keys offline and use a recovery phrase (seed) to restore access. An optional passphrase, or “25th word,” acts as a final barrier. Trezor is one of the leading hardware wallet manufacturers.
The Coldcard attacks in July 2026 stemmed from a firmware glitch that reduced randomness in recovery-phrase generation. Some users who had set passphrases kept their funds safe.
What to Watch
- Whether other hardware wallet makers follow Trezor by raising passphrase length limits.
- Trezor's further investigation of the reported implant and any official findings about the CryptoBilis devices.
- Any patterns of supply-chain attacks targeting cryptocurrency hardware.
Checked
9 claims in this story checked against 1 source: 9 supported.
Show each claim
- SupportedTrezor increased the optional wallet passphrase limit from 50 to 128 characters after the July Coldcard attacks.Cointelegraph.com News: “Trezor cited July’s Coldcard attacks, in which strong passphrases helped protect some users whose wallet recovery information was compromised. Hardware wallet maker Trezor has increased the maximum length of optional wallet passphrases from 50 to 128 characters.”
- SupportedTrezor advised customers who bought wallets from former authorised reseller CryptoBilis since March to move their funds.Cointelegraph.com News: “On Friday, the company advised customers who bought wallets from former authorized reseller CryptoBilis since March to move their funds to new wallets.”
- SupportedAn Indonesian customer reported a suspected implant in a device that could capture on-screen information and transmit it over a cellular network.Cointelegraph.com News: “An Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could capture on-screen information, including recovery phrases, and transmit it over a cellular network.”
- SupportedTrezor cited the July Coldcard attacks, in which strong passphrases protected some users whose recovery information was compromised.Cointelegraph.com News: “Trezor cited July’s Coldcard attacks, in which strong passphrases helped protect some users whose wallet recovery information was compromised.”
- SupportedOn Sunday, Trezor said the change was available in Trezor Suite with updated device firmware, while older firmware still limited passphrases to 50 characters.Cointelegraph.com News: “On Sunday, Trezor said the change is available in its Trezor Suite with updated device firmware. Older firmware still limits passphrases to 50 characters.”
- SupportedAccording to Trezor, a passphrase is an additional password set alongside a wallet’s recovery phrase, and an attacker who gets the recovery phrase would still need the correct passphrase to access funds.Cointelegraph.com News: “According to Trezor, a passphrase acts like an additional password that users set alongside their wallet’s recovery phrase. An attacker who obtains the recovery phrase would still need the correct passphrase to access funds in that wallet.”
- SupportedThe July Coldcard attacks involved a firmware flaw that caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to reconstruct them.Cointelegraph.com News: “Trezor cited the Coldcard attacks in July , when a firmware flaw caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to reconstruct them.”
- SupportedThe suspected implant was reportedly inside a Trezor Safe 5 and could capture on-screen information, including recovery phrases.Cointelegraph.com News: “An Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could capture on-screen information, including recovery phrases, and transmit it over a cellular network.”
- SupportedTrezor said it had not examined the device and had received no reports of related losses.Cointelegraph.com News: “Trezor said Friday it had not examined the device and had received no reports of related losses.”
