Trezor Lets Users Build Longer Passphrases as Hardware Wallet Security Worries Grow

Hardware wallet makers are under pressure after a rough year for self custody. In July, a firmware weakness in Coldcard devices caused some recovery phrases to be created with too little randomness, so attackers were able to work them out and drain funds. Trezor says users who had set a strong, unique passphrase were shielded in some of those cases.

Trezor Passphrase Limit Rises to 128 Characters

With that in mind, Trezor announced on Sunday that optional passphrases can now run up to 128 characters, compared with 50 before. The upgrade comes through Trezor Suite and requires the latest device firmware. Anyone who stays on older firmware remains stuck with the 50 character cap. A passphrase is a second secret that sits on top of the recovery phrase, so a thief holding the seed words still cannot reach the coins without it.

Trezor CryptoBilis Warning for Buyers Since March

The company also issued a separate alert on Friday for customers who purchased from its former authorized seller CryptoBilis after March. They were advised to transfer their funds to a fresh wallet. The warning followed a report from a customer in Indonesia who suspects a Safe 5 contained a hidden part able to read the screen, recovery words included, and send it out over a mobile network. Trezor has not inspected that unit and says no related losses have been reported.