Trezor more than doubles its passphrase limit to 128 characters, citing the Coldcard thefts

Trezor has raised the maximum length of its wallet passphrase from 50 to 128 characters, citing the Coldcard thefts, in which wallets protected by strong passphrases reportedly held up.

The October 2026 update covers the Model T and Safe 3, 5 and 7. The older Model One stays capped at 50.

Trezor introduces 128-character passphrase support

In its November 1 announcement, Trezor confirmed that its October software update now supports passphrases of up to 128 characters, more than double the previous 50-character restriction.

The expanded functionality is available for compatible devices, including the Trezor Model T, Safe 3, Safe 5 and Safe 7. The older Model One retains its existing 50-character limit.

Users must install the updated Trezor Suite software and compatible device firmware before accessing the new restriction. Devices running older firmware will continue operating under the previous character limit.

A passphrase is an optional security feature that works alongside a wallet’s recovery phrase. While the recovery phrase restores access to the underlying wallet, an additional passphrase generates a separate wallet with its own addresses, balances and transaction history.

This distinction is important because someone who obtains a recovery phrase may still be unable to access a wallet protected by an additional passphrase.

Trezor’s documentation explains that users can choose different combinations of characters, from a single word to a longer sentence. However, the company cannot retrieve a forgotten passphrase or reset it on a customer’s behalf.

Consequently, even a minor typing difference can open an entirely different wallet rather than the account containing the user’s cryptocurrency.

Coldcard exploit exposed serious weaknesses in Bitcoin wallet security

Trezor’s decision follows the Coldcard exploit disclosed in July 2026, when a firmware vulnerability weakened the randomness of recovery seeds generated by certain affected devices.

According to blockchain intelligence firm TRM Labs, the underlying issue originated in firmware dating back to March 2021. The vulnerability reduced the effective security of affected wallet seeds from approximately 128 bits to as little as 40 bits, making them significantly easier to reconstruct through offline calculations.

The resulting attacks began on July 30, with approximately 1,816 BTC, worth around $116 million at the time of TRM Labs’ August 5 assessment, reportedly stolen across more than 5,200 addresses in multiple waves.

The incident demonstrated how a weakness in the generation of wallet recovery information could expose cryptocurrency holdings without attackers physically possessing the hardware devices.

Importantly, the vulnerability did not affect every Coldcard user. Exposure depended on whether a wallet’s recovery seed had been generated using vulnerable firmware.

Trezor highlighted another important detail from the incident: some users had added strong, unique passphrases to their wallets. This additional protection reportedly prevented attackers who obtained or reconstructed the compromised recovery information from immediately accessing those funds.

The Coldcard exploit therefore illustrated why an additional authentication secret can provide meaningful protection when the primary wallet backup is exposed.

Longer passphrases bring additional security responsibilities

Despite the security benefits, the expanded character limit comes with responsibilities. Trezor has cautioned that passphrases must be entered exactly as originally created. Capitalization, spaces and individual characters all matter.

In its support guidance, Trezor describes the feature as an advanced security option and warns that forgetting the passphrase can result in permanent loss of access to the associated wallet.

The company also explains that every different passphrase generates a separate wallet. Consequently, a typing mistake could lead users to an apparently empty account, even though their original cryptocurrency holdings remain intact.

Trezor recommends writing down passphrases, storing them securely and regularly testing access to protected wallets.

The Coldcard exploit also demonstrated why updating device software alone cannot always resolve an existing security problem. TRM Labs explained that correcting the vulnerable firmware prevents newly generated seeds from inheriting the weakness, but previously created recovery seeds must be replaced.

Affected Coldcard users were advised to generate entirely new recovery information on updated devices and transfer their assets to newly secured wallets.

Suspected hardware tampering adds to Trezor’s security concerns

The passphrase expansion comes amid another security concern involving Trezor hardware wallets distributed through former authorized reseller CryptoBilis.

On October 30, Trezor disclosed that an Indonesian customer had reported finding an additional circuit board inside a Safe 5 device purchased through the reseller.

According to the customer’s account, the suspected modification included a cellular module and antenna that could potentially capture information displayed on the device’s screen, including wallet recovery phrases, and transmit it through a mobile network.

Trezor said it had reviewed photographs and interviewed the customer but had not yet physically examined the reported device. The company nevertheless considered the disclosure credible enough to issue a precautionary warning.

Trezor Chief Commercial Officer Danny Sanders told The Block: “We’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime.”

The manufacturer advised customers who purchased its devices through CryptoBilis from March 2026 onward to move their cryptocurrency into newly created wallets using fresh recovery phrases.

It also said affected customers could contact its support team regarding replacement devices or vouchers. Trezor reported no confirmed customer fund losses connected to the suspected modification.

Together, these incidents underline the growing importance of hardware integrity, reliable recovery mechanisms and additional wallet protection. The Coldcard exploit has reinforced the need for stronger security practices across the self-custody industry, while Trezor’s latest update gives users another tool to protect their digital assets.