Hardware wallet manufacturer Trezor has increased its maximum passphrase length from 50 to 128 characters, citing lessons from cryptocurrency thefts involving vulnerable Coldcard devices earlier this year.
Summary
- Trezor has expanded its wallet passphrase limit from 50 to 128 characters in its October software update.
- The feature requires updated firmware and supports Model T, Safe 3, Safe 5 and Safe 7 devices.
- Trezor cited July’s Coldcard attacks, where weak recovery phrases exposed Bitcoin wallets to theft.
- Strong, unique passphrases reportedly protected some affected Coldcard users from immediate losses.
- The announcement follows a separate warning about potentially tampered hardware wallets sold through CryptoBilis.
According to Trezor’s November 1 announcement, the change is available through its October software update and requires compatible device firmware. The company said longer passphrases offer experienced users another way to secure cryptocurrency holdings when wallet recovery information becomes exposed.
The announcement follows July’s Coldcard security incident, in which attackers exploited improperly generated recovery phrases to access thousands of Bitcoin addresses.
Trezor expands passphrases to 128 characters
The updated feature allows users to create passphrases containing as many as 128 characters, compared with the previous 50-character limit.
Support covers the Trezor Model T, Safe 3, Safe 5 and Safe 7. The older Trezor Model One continues to support passphrases of up to 50 characters.
Customers must update Trezor Suite and their device firmware to use the expanded limit. Devices running older firmware remain subject to the previous restriction.
According to Trezor’s support documentation, passphrases are optional security features that work alongside a wallet’s recovery phrase.
A recovery phrase provides the information needed to restore a cryptocurrency wallet, while an additional passphrase creates a separate wallet with different addresses and balances.
Accessing the protected wallet requires both the original recovery information and the exact passphrase selected by its owner.
A user can choose a single word, a longer phrase or another supported combination of characters. The company recommends keeping the information private and storing it securely.
Unlike an account password that can be reset through a service provider, a wallet passphrase cannot be recovered by Trezor.
Entering a different passphrase opens another wallet, which may appear empty even when the original wallet still contains funds.
Coldcard attacks exposed weak wallet recovery phrases
Trezor connected the update to the Coldcard attacks disclosed in July 2026, when a firmware problem left some Bitcoin recovery phrases vulnerable to reconstruction.
As crypto.news previously reported, Coldcard firmware generated recovery information with substantially less randomness than intended.
The flaw reduced the effective randomness of affected wallet seeds from approximately 128 bits to 40 bits.
Attackers could potentially recreate vulnerable recovery phrases through repeated calculations, allowing them to access wallets without physically obtaining the devices.
During a July 31 attack, approximately 594 BTC worth $38 million was stolen from around 500 affected wallets within 25 minutes.
Subsequent investigations identified additional suspected thefts involving thousands of Bitcoin addresses.
By August 12, estimates cited in reporting on Coldcard losses had reached approximately $116 million across more than 5,200 addresses.
Trezor said some Coldcard users avoided immediate losses because their wallets required an additional passphrase that attackers could not reconstruct from the compromised recovery information.
A strong passphrase provided extra protection even when the underlying recovery phrase was vulnerable.
Longer passphrases require careful storage
Although the expanded limit allows more characters, Trezor warned that users could permanently lose access to funds if they forget their passphrase.
Every character must match the original entry, including capitalization and spaces.
The company’s guidance explains that passphrases create independent wallets, meaning a small typing mistake can display an entirely different account.
Users therefore need to verify that they can reopen their chosen wallet before transferring cryptocurrency into it.
The manufacturer recommends securely recording passphrases and testing access periodically.
Coldcard responded to its July vulnerability by releasing updated firmware and advising affected customers to create fresh recovery phrases.
In August, the company introduced additional randomness requirements for newly generated wallet seeds.
The updated process requires users to contribute unpredictable input through keyboard activity, dice rolls or coin flips.
Coldcard warned that installing corrected firmware does not repair recovery phrases created using vulnerable versions.
Trezor issues separate warning over tampered devices
The passphrase announcement follows another security warning involving hardware wallets distributed through former authorized reseller CryptoBilis.
On October 30, Trezor warned customers about suspected tampering after an Indonesian buyer reported discovering an additional circuit board inside a Safe 5 device.
According to the company, the suspected implant could potentially collect sensitive information, including wallet recovery phrases.
Trezor said it had reviewed photographs and interviewed the customer but had not physically examined the device.
The company reported no confirmed cryptocurrency losses connected to the suspected modification.
Customers who purchased Trezor wallets through CryptoBilis from March 2026 onward were advised to transfer their assets into newly created wallets using fresh recovery phrases.
Trezor said affected customers could request replacement devices or vouchers, while its investigation continues with assistance from the Security Alliance’s SEAL 911 response service.
