Trezor Raises Passphrase Limit After Coldcard Security Incident

Trezor has raised its optional wallet passphrase limit from 50 to 128 characters, following security concerns highlighted by July’s Coldcard incident. The longer Trezor passphrase is available on the Model T, Safe 3, Safe 5 and Safe 7 after users update Trezor Suite and device firmware; the Model One remains capped at 50 characters. A passphrase adds protection alongside a recovery phrase and can open a separate wallet. Trezor said some users affected by Coldcard’s firmware flaw—which generated recovery phrases with insufficient randomness—were protected because attackers could not reproduce their passphrases. Reports put one theft at about 594 BTC from roughly 500 wallets; broader estimates later cited losses of around $116 million across more than 5,200 addresses. Trezor warns that a forgotten or mistyped passphrase can permanently lock users out of funds. Separately, it advised customers who bought devices through CryptoBilis from March 2026 onward to transfer assets to wallets created with fresh recovery phrases after a customer reported suspected hardware tampering. No related losses have been confirmed. The passphrase change is a wallet-security update, not a direct catalyst for cryptocurrency prices.