Trezor Raises Passphrase Limit to 128 Characters After Coldcard Losses
Trezor has expanded the maximum wallet passphrase length from 50 to 128 characters on supported devices. The change follows July's Coldcard exploit, in which reported losses reached roughly $100 million to $116 million, depending on the estimate used.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Trezor Changed
Trezor raised the maximum passphrase length on its hardware wallets from 50 to 128 characters, according to its November 1 announcement. The change ships with its October software update and requires Trezor Suite and compatible device firmware. Devices on older firmware keep the 50-character limit, and the original Trezor Model One remains capped at 50 characters.
Supported devices are the Trezor Model T, Safe 3, Safe 5 and Safe 7. The company said longer passphrases give experienced users another layer of protection when recovery information has been exposed.
Passphrases and Their Limits
A passphrase is an optional secret that works alongside a wallet's recovery phrase. Entering the correct recovery phrase with a different passphrase opens a separate wallet with different addresses, which may appear empty even when the original wallet holds funds. Trezor cannot recover a forgotten passphrase, unlike an account password that a service provider can reset.
Trezor's guidance stresses that every character must match exactly, including capitalization and spaces. Because a small typing error opens a different wallet, users should confirm they can reopen a chosen wallet before sending funds to it, record the passphrase securely and test access periodically.
The Coldcard Exploit
The update follows a firmware flaw in Coldcard devices that reduced the effective randomness of affected wallet seeds from roughly 128 bits to 40 bits. That made it feasible for attackers to reconstruct vulnerable recovery phrases through repeated calculation, without physically obtaining the devices.
The largest single event occurred on July 31, when about 594 BTC, worth roughly $38 million, was taken from around 500 wallets within 25 minutes. Loss totals grew as further thefts were identified. Reporting cited by crypto.news put cumulative losses at about $116 million across more than 5,200 addresses as of August 12. Bitcoinist described the exploit as contributing to more than $100 million in losses. The two figures reflect different counting windows and methods, and neither source sets out a reconciled total. Users should treat both as estimates.
Where the Protection Held
Trezor said some Coldcard users avoided losses because their wallets also used a passphrase that attackers could not derive from the compromised recovery phrase. Bitcoinist's coverage makes the same point, noting that strong, unique passphrases protected some users whose backups were exposed. Coldcard responded with updated firmware and advised affected customers to generate new recovery phrases.
The passphrase protection is therefore conditional. It helps only where the passphrase is long and unpredictable enough to resist guessing, and where the holder can still reproduce it exactly. Trezor's expansion widens the room for that choice but does not change the risk of losing the passphrase itself.
Why It Matters
For Traders
Bitcoin held in Coldcard wallets with weak or unchanged recovery phrases remains a live theft risk, so any exposed holdings warrant prompt review.
For Investors
Repeated hardware wallet failures are pushing custody security to the center of Bitcoin holder risk, which may shape how institutions evaluate self-custody solutions.
For Builders
Wallet developers should audit seed entropy generation and treat passphrase length and recovery testing as core product requirements rather than optional extras.
This article is for information only and is not financial advice. Read the full disclaimer.
