Trezor expanded its wallet passphrase limit from 50 to 128 characters in its October 2026 software update following major Bitcoin thefts linked to Coldcard seed generation flaws. The update requires compatible device firmware across Model T, Safe 3, Safe 5, and Safe 7 devices. Coldcard users with strong passphrases avoided losses when weak recovery seeds exposed funds. Meanwhile, Trezor warned customers who bought devices from reseller CryptoBilis since March 2026 of potential hardware tampering.
Trezor passphrase expansion update
- ▪Trezor expanded its hardware wallet passphrase maximum length from 50 to 128 characters in its October 2026 Trezor Suite software update.
- ▪Trezor explicitly connected the passphrase expansion to security lessons from the July 2026 Coldcard seed generation vulnerability.
- ▪The Trezor Model One retains a 50-character maximum passphrase limit and does not support the 128-character expansion.
- ▪Trezor's 128-character passphrase limit is supported on Model T, Safe 3, Safe 5, and Safe 7 devices running updated firmware alongside the updated Trezor Suite app.
Coldcard firmware flaw and fix
- ▪A March 17, 2021 firmware update by Coldcard manufacturer Coinkite miswired a software random number generator into device firmware, weakening seed randomness.
- ▪Coldcard responded to the vulnerability by issuing updated firmware and requiring users to contribute unpredictable input via dice rolls, coin flips, or keyboard activity for new seeds.
- ▪The Coldcard firmware flaw reduced the effective entropy of affected Bitcoin wallet recovery seeds from approximately 128 bits to 40 bits.
Bitcoin stolen in Coldcard exploit
- ▪Attackers exploited weak Coldcard recovery phrases to steal over $100 million in Bitcoin across thousands of wallet addresses in multiple attack waves beginning in late July 2026.
- ▪During a 25-minute attack wave on July 31, 2026, attackers stole approximately 594 BTC valued at $38 million from around 500 Coldcard wallets.
Passphrase protection against seed compromise
- ▪Trezor stated that strong, unique passphrases protected some Coldcard users from theft when their underlying seed phrases were compromised.
- ▪A BIP-39 passphrase creates an independent wallet, requiring attackers who reconstruct a weak recovery seed to also guess the correct passphrase to access funds.
Passphrase risks and precautions
- ▪Trezor warned that passphrases cannot be recovered by the company, and entering a mistyped passphrase opens a different wallet, risking permanent fund loss.
- ▪Trezor recommended that wallet users securely record their passphrases and test access periodically.
Trezor Safe 5 hardware tampering warning
- ▪An Indonesian customer reported discovering an implanted circuit board inside a Trezor Safe 5 wallet capable of capturing recovery phrases and transmitting data cellularly.
- ▪Trezor advised customers who bought wallets through CryptoBilis from March 2026 onward to transfer their cryptocurrency assets to new wallets with fresh recovery phrases.
- ▪Trezor issued a security warning on October 30, 2026 regarding suspected hardware tampering in a Safe 5 wallet sold through former authorized reseller CryptoBilis.
Story comments
Loading comments…