Trezor Boosts Passphrase Security Following Coldcard Exploits

The change, deployed via an October software update, requires users to install the latest firmware on their Model T, Safe 3, Safe 5, or Safe 7 devices. While the older Model One remains restricted to 50 characters, newer hardware now allows for significantly more complex entropy. Trezor emphasized that this adjustment serves as a direct response to the July security incident affecting Coldcard devices, where a firmware flaw reduced the randomness of recovery seeds and led to the theft of roughly $116 million in Bitcoin.

During those attacks, users who had enabled a strong, unique passphrase were often spared from losses because their wallets functioned as independent, encrypted containers that could not be reconstructed from the compromised recovery phrases alone. Despite the added protection, Trezor cautioned that the increased complexity brings higher stakes: because these passphrases cannot be reset by any service provider, a single character error or a forgotten sequence will result in the permanent loss of access to the associated funds. The company recommends that users rigorously test their ability to reopen their wallets before transferring assets. This security hardening comes alongside a separate investigation into tampered hardware units sold through the former reseller CryptoBilis, which reportedly contained unauthorized circuit boards capable of harvesting sensitive data.