Trezor Wallet Now Allows Longer Passphrases to Prevent Loss of Funds The cold wallet provider Trezor has now enabled users to set additional passphrases of up to 128 characters, up from the previous maximum of 50 characters. The additional passphrase is a second layer of security, independently set by the user and separate from the 24-word recovery phrase. With this extra layer, even if an attacker obtains the recovery phrase, they cannot access the wallet without the additional passphrase. Trezor implemented this change following attacks on Coldcard wallets in July, during which a device vulnerability allowed attackers to extract recovery phrases, resulting in approximately $100 million in losses. Users who had set strong additional passphrases retained their funds. Trezor also advises customers who purchased wallets from CryptoBilis—a previously authorized dealer—to transfer their funds to a new wallet, after a customer in Indonesia suspected their device had been tampered with to steal recovery phrases, beginning in March.