A recovery phrase is the whole wallet written in words. Whoever has it can rebuild the wallet anywhere, without the device, the app or the owner. Three announcements from the past week, all from wallet makers themselves, are about the same uncomfortable fact: the backup is often the weakest part of self-custody, and it can be exposed long before anyone touches the funds.
A reseller, an implant and a warning before the lab result
On 30 October Trezor told customers who bought its devices from the reseller CryptoBilis from March 2026 onwards to move their funds to a newly created wallet with a new recovery phrase. In its notice, Trezor says it received a responsible disclosure on 28 October about a Trezor Safe 5 bought from CryptoBilis in August through the Indonesian marketplace Tokopedia. The report describes an extra circuit board between the main board and the screen, with a cellular module and an antenna, that reads what the screen shows, including the wallet backup, and sends it out over a mobile network when the device is plugged in.
Trezor is careful about what it knows. It has not yet received the device, so the implant is unverified. It is treating the report as credible on the strength of the customer's description and a video interview. No CryptoBilis buyer has reported a loss of funds. According to a post by Trezor on X, it had already removed CryptoBilis as a reseller on 9 October after reports of tampered Ledger devices sold through it, and the four CryptoBilis-sourced Trezor devices it had inspected since then showed no sign of tampering. Decrypt and CyberInsider covered the warning.
The most important line in the advice is this one: restoring the old backup on another device does not solve the problem. If the backup may have been seen, the backup is the thing that has to be replaced. A new device with the old words is the same wallet.
A longer passphrase, because backups do leak
On 1 November Trezor raised the maximum length of the optional wallet passphrase from 50 to 128 characters, in its October Suite update. A passphrase is an extra secret added to the recovery phrase. Each passphrase opens a separate wallet, so someone holding only the recovery phrase does not reach the funds behind it.
Trezor explained the change with the Coldcard incident of July 2026, when a firmware flaw left some wallet backups with far less randomness than intended and attackers recreated them offline. In Trezor's words, users "with a strong, unique passphrase were protected", because an attacker needed both the weak backup and the passphrase. According to Unchained, the longer limit arrived with firmware 2.13.0, released on 21 October, and covers the Model T, Safe 3, Safe 5 and Safe 7, while the Model One stays at 50. Trezor also warns that a passphrase is an advanced feature: type it wrong or forget it and the funds behind it are out of reach.
Encrypted backups for multi-key wallets
On 3 November Wizardsardine released Liana v16, its Bitcoin wallet built around recovery paths. Its encrypted descriptor backups now follow BIP138, a standard format, so a backup of the wallet's structure is no longer tied to one application. The same release makes taproot the default for new wallets, which keeps unused recovery paths off the chain when coins are spent, and fixes a medium-rated flaw in the fee-bump flow when Liana is connected to a malicious Electrum server.
What the three have in common
Each announcement deals with a different layer: the hardware supply chain, the strength of the secret, and the format of the backup. Together they make one point. Self-custody does not stop at "the keys are mine". It also asks where those keys were created, what could have seen them, and what happens if one copy is exposed.
From the past week we take four practical questions for anyone who holds their own keys:
- Where was the wallet created? A device or computer of unknown history should never be the place where a recovery phrase is generated or typed. Buy through the maker or a reseller the maker lists, and treat any official warning about a sales channel as a reason to act, not to wait for confirmation.
- What has seen the backup? Screens, cameras, cloud photo libraries, password managers and clipboards all count. If the answer is uncertain, the safe fix is a new wallet with a new phrase, not a fresh copy of the old one.
- Is there a second factor on the backup? A strong, unique passphrase, or a multi-key setup with separate recovery paths, means a single exposed phrase is not the end of the story. Write down how it works, so the people who may need it later can follow it.
- Is the backup in a format you can still read in ten years? Standard formats such as BIP39 phrases and BIP138 encrypted descriptors are easier to restore than one vendor's export.
Our view
As XDRIP Digital Management LLC, we build XColdPro, cold wallet software that turns a computer the user already owns into an air-gapped signing environment. We designed it to be software-first and hardware-agnostic: the keys are created and used on a machine that stays offline, and the user decides which machine that is. That choice does not remove supply-chain risk, because every computer has a history. It does put the question of trust where we think it belongs, with the owner, who can choose, inspect and replace the machine.
This week's news is a useful reminder for every self-custody setup, ours included. The device matters, the software matters, but the backup is where most of the long-term risk sits. Make it once, on a machine you trust, protect it with a second secret, and replace it the moment there is a credible reason to doubt it.
Sources
- Trezor, Implant reported in a Trezor sold by CryptoBilis (30 October 2026)
- Trezor on X, CryptoBilis update (30 October 2026)
- Trezor, Trezor Suite update, October 2026: Passphrases now go up to 128 characters (1 November 2026)
- Unchained, Trezor Now Accepts 128-Character Passphrases, Pointing to Coldcard's Seed Flaw (2 November 2026)
- Wizardsardine, Liana 16.0: Multilingual, reworked UI and smarter labels (3 November 2026)
- Decrypt, Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5
- CyberInsider, Trezor warns users to move funds after suspected spy implant report
