Blog

A user updates their Trezor hardware wallet firmware, reconnects it to Trezor Suite, and opens the account view expecting to see their usual address list. Instead, the interface shows only a handful of derived addresses, then stops. The user generates new receive addresses manually, sends a small amount to one of them, and waits for confirmation. Once the transaction settles, more addresses suddenly appear in the suite. This is not a bug. It is the result of a deliberate account gap discovery mechanism that exists to protect both performance and security—but which can hide funds if misunderstood.

The issue becomes clearer when firmware updates, cache clearing, or account rescans occur. Trezor Suite uses the BIP44 hierarchical deterministic standard to derive wallet addresses from a master seed. Because theoretically unlimited addresses can be derived from a single seed, the application cannot display all of them at once. Instead, it uses a gap limit that stops searching for new addresses after a configurable number of consecutive empty addresses are found. A firmware update can reset internal state or cause the application to rescan from scratch, triggering this mechanism in ways that feel like addresses have vanished. Understanding why this happens and how to work around it is essential for anyone managing significant balances across multiple derived accounts.

What the gap limit actually does and why it exists

The gap limit is a scanning boundary that prevents the application from deriving and checking every possible address in a hierarchical wallet. Bitcoin and other UTXO-based cryptocurrencies store balances at individual addresses rather than in a central account ledger. Without a gap limit, Trezor Suite would theoretically need to check addresses one through ten million before deciding that an account was empty. This would be computationally wasteful and would require thousands of blockchain queries just to confirm that a wallet had no funds.

The standard gap limit in most wallet software, including Trezor Suite, is 20 consecutive unused addresses. This means the application will derive and check addresses until it finds 20 in a row with no transaction history. Once that threshold is reached, the scanner stops and does not display any further addresses. The number 20 is arbitrary but well-established in practice. It balances detection speed against the practical scenario of a user who might have created and used many addresses across different sessions or on different devices.

The mechanism becomes problematic when a user has genuinely used more than 20 consecutive addresses without receiving funds on all of them. For example, a user might have created 30 addresses for a payment request, received funds on addresses 5, 15, and 28, then left the wallet idle. If a firmware update or account rescans forces the application to derive from the beginning, it will see empty addresses 1–4, then a transaction on address 5, then empty addresses 6–14, then a transaction on 15, then empty 16–27, then a transaction on 28, then empty 29–35, and stop. All addresses after 35 are now invisible to Trezor Suite, even though they were derived from the same seed and can still receive funds if used directly.

This scenario is more common than it might appear, especially for users who generate batches of addresses for cold storage, give them to multiple people, or use a hardware wallet as a receiving address factory for extended periods. The gap limit does not erase the addresses or make them inaccessible; it simply hides them from the interface until a transaction occurs on one of them.

How firmware updates and rescans trigger the gap mechanism

When a user updates their Trezor device firmware, they typically perform a full factory reset and restore sequence. The hardware wallet itself is not affected—the seed remains the same, and all derived addresses are still mathematically recoverable. However, Trezor Suite on the connected computer may clear its local cache of known addresses and transaction history. The next time the account is opened, the suite must rescan the blockchain from the beginning to rebuild its internal state.

During this rescan, the gap limit applies. If the suite finds transactions on addresses 1, 5, 10, 15, 18, and then encounters 20 consecutive addresses with no activity, it stops scanning. Any addresses beyond that point become invisible, even if they received funds months ago. The user may not realize this has happened because the suite does not warn them. The balance shown is technically correct for the addresses the application is aware of, but it does not represent the true balance of the wallet.

Manual account rescans triggered through the account menu, network reconnections, or clearing the application cache can produce the same effect. On mobile platforms, uninstalling and reinstalling Trezor Suite will reset its cached address state. A user who restores from their recovery seed using a different wallet application, then returns to Trezor Suite, will trigger a full rescan. Each of these operations starts the gap-limit counter at zero.

The situation is compounded by the fact that different blockchains and account types handle address discovery differently. Account-based systems like Ethereum do not use gap limits in the same way because they maintain a single account balance. UTXO chains like Bitcoin, Litecoin, and Dogecoin rely entirely on address scanning, making them vulnerable to the gap-limit problem. A user managing both Ethereum and Bitcoin accounts may incorrectly assume that Trezor Suite’s rescan behavior is uniform across all assets.

Identifying and recovering hidden addresses

The first sign that addresses are hidden is a discrepancy between what the user expects and what Trezor Suite displays. If a user knows they created addresses 1 through 50 and the suite only shows addresses 1 through 25, the gap limit has likely activated. Alternatively, a user might receive a payment notification from an external service but see no corresponding deposit in their Trezor Suite balance, indicating that the address exists and is functional but is not being displayed.

Recovery starts with manual address verification. Most users know which addresses they have shared or used. They can navigate to the address list in Trezor Suite, manually derive additional addresses using the account settings, and check each one for transaction history using a public block explorer. If an address shows a balance or past transactions in the explorer but does not appear in Trezor Suite, the address is trapped behind the gap limit.

The practical solution is to send a small amount (a test transaction or « dust » amount) to the earliest hidden address. Once that transaction settles on the blockchain, Trezor Suite will detect it during the next rescan or sync cycle. The address will then appear in the interface, resetting the gap counter and allowing the application to discover additional addresses beyond it. This sounds like a workaround because it is one, but it is the standard procedure for recovering from gap-limit scenarios across most hardware wallet software.

Another option is to use an external tool such as Trezor’s own address recovery utility or a third-party UTXO scanner configured to derive addresses beyond the default gap limit. These tools can be run offline or against a local blockchain node to identify all addresses that have ever received funds, regardless of the gap limit. The recovered address list can then be imported into watch-only mode in other applications, though this requires understanding the technical process and accepting the security implications of exporting extended public keys.

Why Trezor Suite installation and updates reset local state

Trezor Suite is distributed as a standalone application across Windows, macOS, and Linux, and as native applications on Android and iOS. Each platform stores cached wallet state differently. On desktop systems, the cache is typically stored in the user’s home directory under a hidden configuration folder. On mobile systems, the cache is managed by the application’s sandbox environment.

When a user downloads and installs a new version of Trezor Suite wallet from the official trezor.io domain, the installation process may preserve or clear this cache depending on whether it is an upgrade or a fresh installation. A full uninstall followed by a reinstall will always clear the cache. An over-the-top update within the same major version may preserve it. However, major version bumps sometimes require a full rescan to ensure compatibility with new address derivation standards or blockchain data formats.

Firmware updates to the Trezor device itself do not directly affect Trezor Suite’s cache, but they often prompt the user to disconnect and reconnect the device, which can trigger a rescan operation. Additionally, some firmware updates change how the device reports address state or transaction information, requiring the suite to rebuild its local view even if the cache is not explicitly cleared.

Users who manage their Trezor device management and account controls across multiple computers face a particular risk. If the suite is installed on Computer A with a full address cache, and then later installed on Computer B without that cache, Computer B will perform a fresh address scan using the gap limit. If the user created addresses on Computer A that go beyond the gap threshold on Computer B, those addresses will be hidden until they receive funds.

Best practices for address creation and account management

The simplest way to avoid gap-limit surprises is to minimize the creation of addresses that do not receive funds. Rather than generating a batch of 50 addresses speculatively, generate them as needed. If payment requests require multiple addresses, use a dedicated address labeling or tagging system within Trezor Suite to track which addresses are in use and which are reserved for future payments.

For users who must create many addresses in advance—such as those setting up a cold storage address list or a merchant accepting multiple payment addresses—keep an external record of all addresses created. Write them to a file, print them, or store them in an offline note system. This record becomes a backup for address recovery if the gap limit becomes an issue. The record should be kept offline to avoid exposing it to online threats, but it needs to be accessible if a rescan is necessary.

After any firmware update or major Trezor Suite installation, manually verify the address count in the account view. If the visible address list is significantly shorter than expected, do not assume the addresses are lost; instead, perform a manual rescan or test transaction to the earliest suspected hidden address. This small extra step can prevent hours of troubleshooting later.

For account management specifically, use Trezor Suite’s labeling feature to mark addresses with notes about their purpose or status. This will not prevent the gap limit from hiding them, but it can help you quickly identify which addresses should have been discovered. Additionally, maintain a watch-only view of your Trezor accounts in a separate wallet application for comparison. If the balance or address count differs significantly between applications, the gap limit is likely the cause.

Understanding the trade-off between performance and visibility

The gap limit is a practical constraint, not a design flaw. Without it, wallet applications would be unusable for users with very old seeds or accounts that had used thousands of addresses. The limit allows Trezor Suite to remain responsive even when connected to slow or congested blockchain networks.

However, the gap limit is also a hidden assumption embedded in how Trezor Suite displays balances and addresses. Most users do not read documentation about how BIP44 address discovery works; they expect the suite to show them all addresses and all funds associated with their hardware wallet. The gap limit violates this expectation in edge cases, creating a discrepancy between the true state of the wallet (as recorded on the blockchain and derivable from the seed) and the displayed state (as cached and filtered by the suite).

For users who manage large balances, this gap becomes a real risk. A user with hundreds of thousands of dollars across a Trezor device might perform a rescan and see only a fraction of their addresses and balance, panicking before discovering that the funds are still there but hidden. The solution is not to increase the gap limit indiscriminately—doing so would slow down scanning for everyone—but to provide clearer feedback when a gap limit activation might be occurring, and to offer manual controls for rebuilding the address cache beyond the default threshold.

Looking forward, improvements to Trezor Suite could include explicit notifications when a rescan is being performed, warnings when the gap limit is reached, and easier tools for users to verify that no addresses are hidden. Until those improvements arrive, understanding the mechanism and using the recovery steps outlined above is essential for anyone whose wallet usage exceeds the standard assumptions embedded in the software.

Network conditions and gap-limit discovery timing

The speed at which hidden addresses are rediscovered also depends on network conditions and which blockchain node Trezor Suite is connected to. During a rescan, the application queries a blockchain backend to check each derived address for transaction history. If the backend is slow, overloaded, or temporarily unavailable, the scan may pause or be interrupted. Restarting the application or reconnecting the device can restart the scan, but from the beginning, resetting progress.

When a user sends a test transaction to a hidden address to trigger rediscovery, the confirmation time depends on network congestion and the fee paid. On Bitcoin mainnet, a transaction might take anywhere from minutes to hours to confirm depending on block space demand. Until the transaction is confirmed (usually at least one confirmation block), Trezor Suite may not detect it. Some wallets require a higher confirmation count before considering a transaction final, which can further delay address rediscovery.

For users in high-fee environments, sending a test transaction to recover hidden addresses can be expensive. A user in a Bitcoin fee spike who needs to recover addresses might spend $10 or more just to reactivate address discovery. This cost should be factored into the decision of whether to address the gap limit through a test transaction or to recover addresses using alternative methods such as external tools or watch-only imports.