Trezor has updated its security protocols by increasing the maximum length for optional wallet passphrases from 50 to 128 characters. This feature is currently available within the Trezor Suite for users who install the latest device firmware.
The company implemented this change following security incidents involving Coldcard in July. During those attacks, a firmware vulnerability allowed unauthorized parties to reconstruct recovery phrases, though users with strong passphrases were able to secure their assets.
Additionally, Trezor issued a warning on Friday to customers who purchased devices from the former authorized reseller CryptoBilis since March, recommending that they transfer their funds to new wallets. This follows a report from an Indonesian user regarding a potential hardware implant in a Trezor Safe 5 device capable of capturing sensitive data.
Trezor stated that it has not yet examined the specific device reported by the Indonesian customer and has not received any reports of financial losses related to the alleged implant. The company continues to emphasize the role of passphrases as an essential secondary layer of protection alongside standard recovery phrases.
