Trezor, a leading hardware wallet manufacturer, has increased the maximum length of optional wallet passphrases from 50 to 128 characters. The update, announced on Sunday, is available in the latest version of Trezor Suite and requires updated device firmware. Older firmware versions still cap passphrases at 50 characters.
The change comes in response to the Coldcard attacks in July, where a firmware flaw led to some devices generating recovery phrases with insufficient randomness. Attackers exploited this weakness to reconstruct the phrases and steal funds. Trezor noted that users with strong, unique passphrases were better protected, even if their recovery phrases were compromised.
In addition to the passphrase update, Trezor issued a separate warning on Friday. The company advised customers who purchased wallets from former authorized reseller CryptoBilis since March to move their funds to new wallets. An Indonesian customer reported finding a suspected implant inside a Trezor Safe 5 device, which could capture on-screen information, including recovery phrases, and transmit it over a cellular network. Trezor stated it had not examined the device and received no reports of related losses.