Trezor Raises Passphrase Limit to 128 Characters After $100M Coldcard Blowup

Trezor is handing users a longer lock for their crypto. The hardware wallet maker bumped its passphrase limit to 128 characters, up from the previous 50-character cap, in an update announced November 1. The change ships through updated Trezor Suite software and compatible device firmware — older firmware keeps the original, shorter limit.

The timing is not a coincidence. In July, a firmware vulnerability in rival Coldcard devices caused some units to generate recovery phrases with not enough randomness, letting attackers reconstruct vulnerable backups and walk off with funds. Reports put the losses from that mess above $100 million, according to bitcoinist. Trezor pointed to the incident as a reminder of why extra layers matter.

A passphrase sits on top of the recovery phrase as a second secret. Even if an attacker gets hold of the seed words, they still need the exact passphrase to open the wallet. Trezor says some Coldcard-affected users who had set strong, unique passphrases kept their funds safe despite their compromised recovery information.

Trezor is also drawing a line for its own users. Wallets first created on Trezor devices were never touched by the Coldcard firmware flaw, the company says. But anyone who generated a recovery phrase on a vulnerable Coldcard and later restored it on a Trezor is still exposed — swapping hardware does not fix a bad seed. The only real escape is moving funds to a freshly generated wallet.

The longer limit comes with a warning label. Passphrases remain an advanced feature: every different passphrase spins up a completely separate wallet, so a single mistyped character can drop a user into an empty one instead of the wallet holding their coins. Trezor cannot recover a lost or forgotten passphrase, which means a slip-up can lock funds away permanently.

The takeaway for self-custody holders is that no single safeguard carries the whole load — reliable key generation, careful backups and a well-stored passphrase all have to line up. A longer passphrase adds real protection, but only if users can reproduce it exactly, every time.