Trezor Enhances Security with Longer Passphrases After Coldcard Exploit

Hardware wallet manufacturer Trezor has announced an expansion of its passphrase limit to 128 characters, significantly increasing security options for users following a major vulnerability in Coldcard wallets. This update, effective from November 1, is available through the latest Trezor Suite software and compatible device firmware.

The previous limit of 50 characters has been extended to provide users with stronger protection for their cryptocurrency holdings. A passphrase serves as an additional security layer alongside a wallet's recovery phrase, ensuring that even if an attacker gains access to the recovery phrase, they cannot access the wallet without the correct passphrase.

This move comes in the wake of a July incident involving Coldcard, where a firmware vulnerability led to the generation of recovery phrases with insufficient randomness. This flaw resulted in over $100 million in reported losses as attackers exploited the weakness to reconstruct wallet backups. Trezor noted that some users who had implemented strong, unique passphrases were able to protect their funds despite the compromised recovery information.

While the new longer passphrase option provides enhanced security, Trezor cautions users about the complexities involved. Each unique passphrase generates a separate wallet, meaning a minor mistake in typing could lead to accessing an entirely different wallet. Furthermore, lost or forgotten passphrases cannot be recovered, potentially leaving users unable to access their cryptocurrency.

This update underscores the importance of robust security measures in the cryptocurrency space, emphasizing that effective self-custody requires reliable key generation and careful recovery practices.