Trezor's core firmware 2.13.0 changelog dated October 21, 2026 lists Trezor's passphrase limit as 128 bytes, which rolled out in Suite desktop version 26.10.3 and mobile version 26.10.2

Overview Debates Related claims Topics Sources

A March 17, 2021 firmware migration error caused Coinkite Coldcard devices to run seed generation on a software generator instead of hardware, producing weak recovery phrases

Using a 128-character passphrase on a Trezor device requires both the latest Trezor Suite app and updated device firmware, while older Trezor firmware retains a 50-character limit

Attackers reconstructed weak Coldcard recovery phrases to access wallets, but users with strong, unique passphrases were protected from the Coldcard attacks

Trezor stated that increasing Trezor's passphrase length was prompted by user inquiries following the July 2026 Coldcard seed generation flaw

Trezor designated Trezor's passphrase feature as an advanced feature and warned users that a mistyped or forgotten passphrase can result in lost funds

On August 2, 2026, X account BTC Sessions reported the first confirmed loss from the July 2026 Coldcard seed flaw thefts involving a device using a weak two-word passphrase

Coinkite advised that Coldcard wallets were vulnerable unless created with 50 independent dice rolls or protected by a strong, unique passphrase

Trezor stated in August 2026 that its own hardware wallets were unaffected by the July 2026 Coldcard seed generation flaw, but advised users to move wallets created on a Coldcard and restored on a Trezor

Trezor Model T, Safe 3, Safe 5, and Safe 7 hardware wallets support 128-character passphrases, whereas the Trezor Model One maintains a 50-character limit

Tether CEO Paolo Ardoino said Tether expands its global footprint by adding approximately 30 million new digital wallets every quarter

Wasabi Wallet restricted its operations and withdrew its services from the United States following regulatory actions against privacy tools

A user can reconstruct lost Shielded Bitcoin notes by scanning the Bitcoin blockchain with the user's private key

Trezor announced plans to significantly reduce and restructure its global authorized reseller network beginning January 1, 2027, to strengthen supply chain control.

The reported hardware implant inside the Trezor Safe 5 allegedly reads information displayed on the screen, including the recovery phrase, and transmits it over a mobile network when plugged into power.

Ledger asked authorized resellers and distributors across Malaysia, Indonesia, Singapore, Thailand, Philippines, Vietnam, and Hong Kong to halt device sales following supply chain security compromises.

An Indonesian user reported finding an extra circuit board with a cellular module and antenna between the screen and main board of a Trezor Safe 5 bought from CryptoBilis via Tokopedia in August 2026.

Trezor is offering replacement devices shipped directly by the company or vouchers for a new wallet to customers who purchased Trezor devices through CryptoBilis.

Trezor stated on October 30, 2026, that it treats the hardware implant report as credible while arranging to examine the affected Trezor Safe 5 device in its laboratory.

The Singapore Police Force issued a public advisory on October 28, 2026, regarding tampered Ledger hardware wallets carrying malicious components that resulted in $3.5 million in reported losses.

Trezor reported on October 30, 2026, that it received a customer report regarding a suspected malicious hardware implant in a Trezor Safe 5 wallet purchased from reseller CryptoBilis.