Most Trezor wallets can now take a passphrase of up to 128 characters, up from the old cap of 50, the hardware wallet maker announced in its Nov. 1 Trezor Suite update post. The longer limit requires the newest Suite app plus a firmware update on the device, and Trezor said older firmware “will still have a 50-character limit.”
Trezor put the change in the context of the Coldcard thefts that began in late July. Its post said a firmware flaw left some Coldcard backups with far less randomness than intended, and that users “with a strong, unique passphrase were protected” because “an attacker needed both the weak backup and the passphrase to reach their wallet.” Trezor said the question it then kept hearing was whether a longer passphrase was possible.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
How the Coldcard Seeds Failed
Galaxy Digital’s head of research, Alex Thorn, traced the problem to an older firmware change. “Coldcard had updated their firmware on March 17th, 2021 to add their own version of a random number generator,” Thorn said on Unchained’s Bits + Bips in early August, adding that “they miswired it into the firmware.”
Coinkite, the company behind Coldcard, has described the cause as a build and link error from that March 2021 migration, which left seed generation running on a general-purpose software generator instead of the device’s hardware one. Attackers then rebuilt the weak seeds offline, Coinkite said. Galaxy Research estimated on X on Aug. 3 that about 1,596 BTC had been taken from roughly 7,300 addresses across three confirmed waves plus 14 smaller incidents, putting losses above $100 million. Unchained later reported that Thorn was tracking a suspected fourth wave.
Why Passphrase Length Matters
A BIP-39 passphrase, added on top of the seed, opens a separate wallet with its own addresses. That means an attacker who reconstructs a weak seed still has to guess the passphrase before reaching the funds. Coinkite’s guidance put affected wallets at risk unless the seed was created with at least 50 independent, private dice rolls or the wallet carried a strong, unique passphrase, warning that a “short, common, patterned, quoted, reused, exposed, or uncertain passphrase does not qualify.”
At least one short passphrase reportedly did not hold. On Aug. 2, the X account BTC Sessions reported on X what it called the first confirmed loss of “a Mk3 + 2 Word Passphrase.” Trezor wrote in an August post that cracking tools work through dictionary words, leaked passwords and patterns, and that “length alone doesn’t guarantee entropy.”
Which Trezor Devices Get It
Per Trezor’s guide, the Model T, Safe 3, Safe 5 and Safe 7 all support the longer passphrases; the Model One keeps its 50-character maximum. The changelog for core firmware 2.13.0, dated Oct. 21, describes the new ceiling as “128 bytes,” while Trezor’s post and guide count it in characters. The October release notes list the feature in Suite 26.10.3 on desktop and 26.10.2 for the mobile app, and say updates roll out in stages.
Trezor said in August that its own devices were not affected by the Coldcard flaw, though wallets first created on a Coldcard and later restored on a Trezor should be moved. The passphrase update comes days after Trezor said it was treating as credible a report of an implanted Safe 5 sold by former reseller CryptoBilis.
Trezor’s post also called the passphrase “an advanced feature” and warned that a mistyped or forgotten one can mean lost funds.
Related Listen: Bits + Bips: Is Any Cold Wallet Safe? Inside the Coldcard Hack’s Wave Three
The post Trezor Now Accepts 128-Character Passphrases, Pointing to Coldcard’s Seed Flaw appeared first on Unchained.
Powered by WPeMatico
