Trezor raises passphrase limit to 128 characters after Coldcard attacks

A passphrase functions as an additional password that users set alongside a wallet's recovery phrase. According to Trezor, an attacker who obtains the recovery phrase would still need the correct passphrase to access funds held in that wallet, making the extra layer a meaningful defence if backup information is compromised.

Trezor pointed to July's Coldcard attacks, in which a firmware flaw caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to reconstruct them. Trezor said strong, unique passphrases protected some affected users whose wallet recovery information was exposed.

The passphrase change comes alongside a separate warning concerning Trezor's own devices. On Friday, the company advised customers who bought wallets from former authorized reseller CryptoBilis since March to move their funds to new wallets. An Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could capture on-screen information, including recovery phrases, and transmit it over a cellular network. Trezor said Friday it had not examined the device and had received no reports of related losses.