Daily crypto headlines span exploits ($40M Mercado Bitcoin hack, $106M EU exchange theft), regulatory wins (New Jersey drops Coinbase staking suit), protocol recovery (Liquid Network fully backed post-$320M exploit), and infrastructure updates (Trezor passphrase limit raised to 128 characters).
Security & Exploits ·
Trezor has extended the maximum length for optional wallet passphrases to 128 characters, up from a previous 50-character limit. The hardware wallet maker rolled out the change via Trezor Suite with updated device firmware, though devices running older firmware remain capped at 50 characters. A passphrase functions as an additional layer of security alongside a wallet's recovery phrase; even if an attacker obtains the recovery phrase, they would need the correct passphrase to access funds.
The upgrade was prompted by events in July involving Coldcard devices, where a firmware vulnerability generated recovery phrases with weak randomness, enabling attackers to recreate them. Trezor noted that users with strong, unique passphrases were better protected during that incident. The move underscores the value of longer, more complex passwords in mitigating risk when seed material is compromised.
The change comes amid separate security concerns for Trezor itself. On Friday, the company advised customers who purchased wallets from former authorized reseller CryptoBilis since March to transfer funds to new devices, citing a suspected implant found in a Trezor Safe 5 that may have captured on-screen data including recovery phrases. Trezor has not examined the device and reported no confirmed losses tied to the incident.