Trezor turns up passphrase protection to 128 characters after wallet scares 🔐

Hardware wallet maker Trezor has increased the maximum length of optional wallet passphrases from 50 to 128 characters. The change is available in Trezor Suite with updated device firmware, while older firmware continues to limit passphrases to 50 characters.

According to Trezor, a passphrase serves as an additional password set alongside a wallet’s recovery phrase. Even if an attacker obtains the recovery phrase, the correct passphrase is still required to access funds in that wallet. Strong, unique passphrases protected some users affected by the Coldcard attacks in July, when a firmware flaw caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to reconstruct them.

The update follows a separate warning issued Friday by Trezor, which advised customers who purchased wallets from former authorized reseller CryptoBilis since March to move their funds to new wallets. An Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could capture on-screen information, including recovery phrases, and transmit it over a cellular network.

Trezor said Friday that it had not examined the reported device and had received no reports of related losses.