Hardware wallet manufacturer Trezor has increased the maximum length of optional wallet passphrases from 50 to 128 characters. The update, announced on Sunday, is available through Trezor Suite and requires updated device firmware; older firmware versions continue to enforce the previous 50-character limit. Trezor explained that a passphrase functions as an additional security layer alongside the recovery phrase, meaning an attacker who obtains the recovery phrase would still require the correct passphrase to access funds.
The company cited recent security incidents involving competitor Coldcard in July, where a firmware flaw caused some devices to generate recovery phrases with insufficient randomness. This vulnerability allowed attackers to reconstruct phrases, though Trezor noted that strong, unique passphrases protected some affected users during those attacks.
This enhancement follows a separate advisory issued by Trezor on Friday regarding its own supply chain. The company advised customers who purchased wallets from former authorized reseller CryptoBilis since March to move their funds to new devices. The warning came after an Indonesian customer reported a suspected hardware implant inside a Trezor Safe 5 capable of capturing on-screen information, including recovery phrases, and transmitting it via cellular network. Trezor stated it had not examined the specific device and had received no reports of related financial losses.
Trezor’s expansion of the passphrase character limit reflects a strategic response to evolving threat vectors in self-custody infrastructure. By allowing longer passphrases, the company increases the entropy required for brute-force attacks, directly addressing vulnerabilities exposed by the Coldcard incident where weak randomness made recovery phrases predictable. This move underscores the industry's shift toward layered security models, where the recovery phrase alone is no longer considered sufficient protection against sophisticated adversaries who may exploit firmware flaws or supply chain compromises.
However, the simultaneous disclosure of potential hardware implants via a former reseller highlights persistent operational risks in the distribution channel. While software updates can mitigate cryptographic weaknesses, they cannot fully protect against physical tampering at the point of sale. The lack of confirmed losses in the CryptoBilis case suggests either early detection or limited scope, but it serves as a critical reminder that user trust relies heavily on rigorous vendor vetting and secure logistics, independent of the wallet’s internal encryption standards.
