Cc9f267dcClaimA BIP-39 passphrase creates an independent wallet, requiring attackers who reconstruct a weak recovery seed to also guess the correct passphrase to access funds.AgreeDisagree
Cc9f267dcClaimTrezor explicitly connected the passphrase expansion to security lessons from the July 2026 Coldcard seed generation vulnerability.AgreeDisagree
Cc9f267dcClaimAn Indonesian customer reported discovering an implanted circuit board inside a Trezor Safe 5 wallet capable of capturing recovery phrases and transmitting data cellularly.AgreeDisagree
Cc9f267dcClaimAttackers exploited weak Coldcard recovery phrases to steal over $100 million in Bitcoin across thousands of wallet addresses in multiple attack waves beginning in late July 2026.AgreeDisagree
Cc9f267dcClaimTrezor expanded its hardware wallet passphrase maximum length from 50 to 128 characters in its October 2026 Trezor Suite software update.AgreeDisagree
Cc9f267dcClaimTrezor issued a security warning on October 30, 2026 regarding suspected hardware tampering in a Safe 5 wallet sold through former authorized reseller CryptoBilis.AgreeDisagree
Cc9f267dcClaimThe Coldcard firmware flaw reduced the effective entropy of affected Bitcoin wallet recovery seeds from approximately 128 bits to 40 bits.AgreeDisagree
Cc9f267dcClaimTrezor advised customers who bought wallets through CryptoBilis from March 2026 onward to transfer their cryptocurrency assets to new wallets with fresh recovery phrases.AgreeDisagree
Cc9f267dcClaimTrezor warned that passphrases cannot be recovered by the company, and entering a mistyped passphrase opens a different wallet, risking permanent fund loss.AgreeDisagree
Cc9f267dcClaimTrezor stated that strong, unique passphrases protected some Coldcard users from theft when their underlying seed phrases were compromised.AgreeDisagree
Cc9f267dcClaimA March 17, 2021 firmware update by Coldcard manufacturer Coinkite miswired a software random number generator into device firmware, weakening seed randomness.AgreeDisagree
Cc9f267dcClaimTrezor's 128-character passphrase limit is supported on Model T, Safe 3, Safe 5, and Safe 7 devices running updated firmware alongside the updated Trezor Suite app.AgreeDisagree
Cc9f267dcClaimDuring a 25-minute attack wave on July 31, 2026, attackers stole approximately 594 BTC valued at $38 million from around 500 Coldcard wallets.AgreeDisagree
Cc9f267dcClaimColdcard responded to the vulnerability by issuing updated firmware and requiring users to contribute unpredictable input via dice rolls, coin flips, or keyboard activity for new seeds.AgreeDisagree
Cc9f267dcClaimThe Trezor Model One retains a 50-character maximum passphrase limit and does not support the 128-character expansion.AgreeDisagree
Cc9f267dcClaimEthereum Classic and Bitcoin Gold were subjected to 51% attacks enabled by rentable graphics processing unit hash rateAgreeDisagree
Cc9f267dcClaimCertain Ledger hardware wallets were distributed and sold with tampered firmwareAgreeDisagree
Cc9f267dcClaimHardware cryptocurrency wallets rely on a physical supply-chain chain of trust established at the point of purchaseAgreeDisagree
Cc9f267dcClaimBitfinex retains only the minimum reserve balance in its hot wallets necessary to service pending customer withdrawalsAgreeDisagree