An Indonesian customer reported discovering an implanted circuit board inside a Trezor Safe 5 wallet capable of capturing recovery phrases and transmitting data cellularly.

Overview Debates Related claims Topics Sources

As of early November 2026, approximately 7.1 million Bitcoin, representing roughly 35% of the circulating supply, sat in legacy addresses with exposed public keys vulnerable to quantum computer attacks

Because the Bitcoin network cannot distinguish between a quantum thief and a true owner, legitimate holders moving vulnerable legacy Bitcoin under Cory Fields' quantum landmine proposal would also be forced to post equal matching collateral

Under Cory Fields' proposed landmine rules, stealing 1 BTC using quantum attacks requires matching 1 BTC collateral from a quantum-safe wallet, locking both for 30 days while the legitimate Bitcoin owner reveals secret proof to reclaim funds and forfeit collateral

Quantum landmines utilize a commit/reveal mechanism where an owner secretly prepares a trap in a quantum-safe format before quantum attacks become possible

Satoshi Nakamoto's early Bitcoin holdings are among the potential targets vulnerable to quantum key-reversal attacks because early transactions exposed their public keys onchain

A BIP-39 passphrase creates an independent wallet, requiring attackers who reconstruct a weak recovery seed to also guess the correct passphrase to access funds.

Trezor explicitly connected the passphrase expansion to security lessons from the July 2026 Coldcard seed generation vulnerability.

Attackers exploited weak Coldcard recovery phrases to steal over $100 million in Bitcoin across thousands of wallet addresses in multiple attack waves beginning in late July 2026.

Trezor expanded its hardware wallet passphrase maximum length from 50 to 128 characters in its October 2026 Trezor Suite software update.

Trezor issued a security warning on October 30, 2026 regarding suspected hardware tampering in a Safe 5 wallet sold through former authorized reseller CryptoBilis.

The Coldcard firmware flaw reduced the effective entropy of affected Bitcoin wallet recovery seeds from approximately 128 bits to 40 bits.

Trezor advised customers who bought wallets through CryptoBilis from March 2026 onward to transfer their cryptocurrency assets to new wallets with fresh recovery phrases.

Trezor warned that passphrases cannot be recovered by the company, and entering a mistyped passphrase opens a different wallet, risking permanent fund loss.

Trezor stated that strong, unique passphrases protected some Coldcard users from theft when their underlying seed phrases were compromised.

A March 17, 2021 firmware update by Coldcard manufacturer Coinkite miswired a software random number generator into device firmware, weakening seed randomness.

Trezor's 128-character passphrase limit is supported on Model T, Safe 3, Safe 5, and Safe 7 devices running updated firmware alongside the updated Trezor Suite app.

Trezor recommended that wallet users securely record their passphrases and test access periodically.

During a 25-minute attack wave on July 31, 2026, attackers stole approximately 594 BTC valued at $38 million from around 500 Coldcard wallets.

Coldcard responded to the vulnerability by issuing updated firmware and requiring users to contribute unpredictable input via dice rolls, coin flips, or keyboard activity for new seeds.

The Trezor Model One retains a 50-character maximum passphrase limit and does not support the 128-character expansion.