Trezor Raises Passphrase Limit to 128 Characters After Coldcard Wallet Thefts

TL;DR

• Trezor increased its optional passphrase limit from 50 to 128 characters, citing lessons from July’s Coldcard attacks and demand for stronger passphrase options.
• Coldcard’s firmware flaw generated backups with insufficient randomness, allowing attackers to reconstruct affected wallets offline, while strong unique passphrases protected some users during initial thefts.
• The update requires device firmware, but longer passphrases do not replace secure backup handling or protect users from phishing and social-engineering attacks.

Trezor has raised the maximum optional wallet passphrase length from 50 to 128 characters, citing lessons from the July Coldcard attacks in its October Trezor Suite update. The change gives advanced users more room to create strong, unique passphrases alongside their wallet backups. It also reinforces the role of layered defenses explored in this hardware-wallet security analysis. Older firmware retains the previous 50-character ceiling, so users need updated device firmware to access the expanded limit.

Longer Passphrases Add Another Layer After Coldcard’s Seed Failure

A passphrase functions as an additional secret layered on top of the wallet backup, with each different passphrase opening a separate wallet containing its own addresses, balances and transaction history. Trezor stresses that the feature is intended for advanced users because forgetting or mistyping the passphrase can prevent access to the intended wallet. The company recommends treating it with the same care as the recovery backup itself rather than viewing greater length as automatic protection.

The update follows a Coldcard firmware flaw that produced wallet backups with substantially less randomness than intended. Attackers could reconstruct affected backups offline and drain funds from thousands of addresses. Trezor said some users with strong, unique passphrases avoided losses in the initial attacks because attackers still needed that additional secret. The incident was initially documented through a coordinated theft of 594 BTC before subsequent waves expanded the scope.

The Coldcard incident also created secondary security pressure. Phishing groups exploited fear around the vulnerability to target hardware-wallet users, prompting warnings about fake audits, malicious downloads and attempts to obtain recovery information. That broader fallout was covered in warnings from hardware-wallet providers. Longer passphrases do not remove those social-engineering risks, and Trezor explicitly warns that a passphrase remains sensitive information whose loss can be permanent.

The October release includes additional Trezor Suite changes, but the 128-character expansion directly addresses demand for stronger passphrase options after the Coldcard episode. It does not change the basic security model: users still need both their wallet backup and exact passphrase to reach the corresponding wallet. The wider incident has also produced legal action over the Coldcard security flaw, underscoring how compromised randomness can affect self-custody long after a seed is created. For Trezor users, the update adds more passphrase capacity, not a substitute for secure backup handling. Its value ultimately depends on careful user practice.