Trezor Expands Passphrase Character Limit Following Coldcard's $100M Security Breach

Trezor Expands Passphrase Character Limit Following Coldcard's $100M Security Breach

In response to Coldcard security incidents, Trezor has extended its maximum wallet passphrase capacity from 50 characters to 128, emphasizing how passphrases safeguard wallets when compromised.

Cryptocurrency hardware wallet manufacturer Trezor has expanded the maximum character count for optional wallet passphrases, increasing the limit from 50 characters to 128 characters.

The enhancement was announced by Trezor on Sunday, confirming that the modification is now accessible through its Trezor Suite application with the latest device firmware update. Users running previous firmware versions will continue to experience the 50-character passphrase restriction.

In Trezor's explanation, a passphrase functions as an extra layer of password protection that wallet owners can establish in addition to their wallet's recovery phrase. Should a malicious actor gain access to the recovery phrase, they would still require the accurate passphrase to gain entry to the funds stored within that particular wallet.

The company referenced the Coldcard security incidents that occurred in July, during which a vulnerability in the firmware resulted in certain devices producing recovery phrases that lacked adequate randomness, making it possible for attackers to reverse-engineer them. According to Trezor, some users who were impacted by these attacks remained protected because they had implemented strong and unique passphrases.

This update arrives on the heels of a distinct security alert concerning Trezor's own hardware devices.

Last Friday, the manufacturer issued an advisory to customers who had purchased wallets from CryptoBilis, a former authorized reseller, since March, recommending they transfer their funds to newly created wallets.

A customer from Indonesia had reported discovering a suspected malicious implant embedded within a Trezor Safe 5 device that appeared capable of recording on-screen data, including recovery phrases, and broadcasting it through a cellular network connection. Trezor indicated on Friday that they had not yet physically inspected the device in question and had not received any reports of monetary losses connected to this issue.