Hardware wallet manufacturer Trezor has expanded the maximum length for optional wallet passphrases from 50 to 128 characters. The company announced the update on Sunday, noting that the new feature is available through Trezor Suite with updated device firmware. Users running older firmware versions will continue to face the previous 50-character restriction. This change aims to enhance security for users who employ passphrases as an additional layer of protection beyond their standard recovery phrases.

Trezor explained that a passphrase functions as a secondary password set alongside the primary recovery phrase. In this model, an attacker who obtains the recovery phrase still requires the correct passphrase to access the funds within the wallet. By allowing longer passphrases, Trezor enables users to create more complex and unique strings, thereby increasing the difficulty for potential attackers to guess or brute-force the additional credential.

Response to Coldcard Vulnerabilities

The decision to raise the passphrase ceiling follows significant security incidents involving competitor Coldcard in July. According to Cointelegraph, a firmware flaw in certain Coldcard devices resulted in the generation of recovery phrases with insufficient randomness. This vulnerability allowed attackers to reconstruct the recovery phrases of affected users. Trezor stated that strong, unique passphrases helped protect some of these users, as the attackers lacked the secondary credential necessary to access the funds despite having the compromised recovery data.

The company highlighted this incident to underscore the value of robust passphrase practices in mitigating risks associated with hardware wallet vulnerabilities. By extending the character limit, Trezor seeks to encourage users to adopt more secure passphrase strategies, reducing the likelihood of total fund loss in the event that primary recovery information is exposed through similar technical flaws.

Warning on Compromised Reseller Devices

In a separate security advisory issued on Friday, Trezor warned customers who purchased wallets from former authorized reseller CryptoBilis since March to transfer their funds to new devices. This warning came after an Indonesian customer reported a suspected implant inside a Trezor Safe 5 unit. The reported implant was allegedly capable of capturing on-screen information, including recovery phrases, and transmitting it over a cellular network.

Trezor noted that it had not examined the specific device in question and had not received reports of financial losses related to this particular incident. However, the company emphasized the importance of vigilance regarding the supply chain and advised users to verify the integrity of their hardware. The simultaneous release of the passphrase update and the reseller warning highlights the company's focus on addressing multiple vectors of potential security threats.

What to Watch Next

Users should check their device firmware versions to ensure they have access to the extended 128-character passphrase limit. Those who purchased devices from CryptoBilis should follow the company’s guidance to migrate assets to new, verified hardware. Additionally, the broader industry may see increased scrutiny on hardware wallet supply chains and firmware integrity following these recent incidents. Developers of other hardware wallets may also consider similar security enhancements in response to the demonstrated risks of compromised recovery phrases.