Trezor lifts password ceiling after Coldcard’s $100M wallet thefts

Hardware wallets such as Trezor and Coldcard use recovery material to restore access to funds, and passphrases add an extra layer on top of that setup. Trezor’s Nov. 1 Suite update sits in that context, with the company pointing to the July Coldcard thefts and the limits of weak recovery setups. The change also fits a broader pattern in self-custody tools: users get more control, but they also have to manage more security steps.

For people who use Trezor wallets, a 128-character ceiling gives more room for longer passphrases, but the feature is still optional and depends on newer software and device firmware. Users on older firmware keep the 50-character limit, so some wallets will not get the new setting until they update. The warning about passphrase risk means the new option is not a simple switch to turn on without understanding the trade-offs.

The wider issue is the gap between convenience and security in self-custody. Longer passphrases can make recovery harder for attackers, but they also add complexity for legitimate users who must store and remember them correctly. Trezor’s move shows how wallet makers respond after a public theft episode by changing defaults and limits rather than removing self-custody features. (per cointelegraph.com)

Still open is how many users will update to the newest Suite app and firmware, and how many will keep the older 50-character cap in place. It is also not clear from the available details how many of the affected Coldcard users relied on passphrases versus other recovery setups. The next concrete marker would be whether Trezor changes other parts of its recovery process or whether other wallet makers follow with similar limits.