Trezor Increases Password Limits After Coldcard Theft

Trezor, the hardware wallet manufacturer, has modified its security architecture by increasing the maximum length of the optional passphrase from 50 to 128 characters in the firmware and Trezor Suite application. This feature is available after a software update. The change is a response to the theft of digital assets worth $100 million that occurred in July 2026 due to attacks on Coldcard wallet users. A flaw in the firmware allowed attackers to reconstruct recovery seed phrases. Trezor emphasizes that strong passphrases helped some investors avoid losses. Additionally, Trezor warns customers who purchased wallets from the former authorized dealer CryptoBilis since March 2026 about possible tampering with the devices. A customer from Indonesia reported that his Trezor Safe 5 model contained a spy implant. The manufacturer has not yet conducted a detailed analysis, and no thefts related to this case have been reported so far.