Trezor Extends Passphrase Protection to 128 Characters Following Coldcard Security Incidents

Enhanced Passphrase Security Strengthens Hardware Wallet Protection

Hardware wallet manufacturer Trezor announced an upgrade to its device security architecture, responding to vulnerabilities highlighted by recent attacks in the crypto hardware wallet space. According to Trezor, the company has expanded the maximum length of optional wallet passphrases from 50 to 128 characters, a move designed to provide users with substantially stronger protection mechanisms for their digital assets.

The updated passphrase functionality is now available through Trezor Suite, accompanied by new firmware releases for supported devices. Trezor explained that devices running older firmware versions will continue to operate under the previous 50-character limitation until users install the latest updates. In Trezor’s security model, a passphrase operates as an additional authentication layer—a supplementary password that users establish independently of their wallet’s recovery seed phrase. This two-factor approach means that even if an attacker obtains a user’s recovery phrase, they would still need the correct passphrase to access the wallet’s funds.

Response to Industry Vulnerabilities

Trezor justified this significant enhancement by referencing security incidents affecting competing hardware wallets. The company specifically cited Coldcard devices, which experienced major attacks in July. According to Trezor, a firmware vulnerability in those devices caused some units to generate recovery phrases using insufficient randomness, enabling attackers to mathematically reconstruct the phrases and drain cryptocurrency. Trezor highlighted that among Coldcard users whose recovery information was compromised, those who had created particularly strong and distinctive passphrases managed to retain protection of their assets, underscoring the critical importance of robust secondary authentication mechanisms.

Additional Supply Chain Security Warnings

Beyond the firmware enhancement, Trezor issued a separate security advisory addressing potential supply chain risks. The company warned customers who purchased Trezor devices from CryptoBilis, a former authorized reseller, to transfer their funds to newly acquired wallets if their purchase occurred at any point since March. An Indonesian user reported discovering what appeared to be unauthorized hardware modifications within a Trezor Safe 5 device. The suspected implant allegedly could intercept visual information displayed on the device’s screen—including recovery phrases shown during wallet initialization—and transmit this data through a cellular connection. Trezor stated that as of the announcement, the company had not conducted a direct examination of the affected device and had recorded no confirmed incidents of customer losses attributable to this potential vulnerability.

Enhanced hardware wallet security and proactive vulnerability response strengthen the foundational infrastructure that maintains user trust across the broader cryptocurrency ecosystem.

Source: Trezor, via Cointelegraph. Not financial advice.