News
Public · Published
Trezor lifts password ceiling after Coldcard's $100M wallet thefts
Trezor raised the maximum optional wallet passphrase length from 50 to 128 characters in Trezor Suite with updated device firmware; older firmware remains capped at 50. The company cited Coldcard attacks in July, when a firmware flaw weakened recovery phrases and strong, unique passphrases protected some affected users.
Published:
Updated:
What happened
Trezor raised the maximum optional wallet passphrase length from 50 to 128 characters in Trezor Suite with updated device firmware; older firmware remains capped at 50. The company cited Coldcard attacks in July, when a firmware flaw weakened recovery phrases and strong, unique passphrases protected some affected users.
Confirmed
Global impact / market context
A longer optional passphrase can provide another barrier if someone obtains a wallet’s recovery phrase, potentially reducing the chance of stolen funds for users who set one. The change may also affect customer confidence and demand for hardware wallets after reported security concerns.
Analyst inference
The update follows two security concerns described in the article: Coldcard devices generated weak recovery phrases after a firmware flaw, and an Indonesian customer suspected an implant in a Trezor device. Trezor said it had not examined that device and reported no related losses.
Confirmed
What to watch
- Check whether Trezor expands the longer passphrase limit to older firmware; the article says those versions remain capped at 50 characters. Analyst inference
- Watch for details on Trezor’s investigation of the suspected implant, including whether the company examines the device or reports related losses. Analyst inference
- Customers who bought wallets from CryptoBilis since March were advised by Trezor to move funds to new wallets; follow any further customer guidance. Confirmed