Principle 01
Remove
The highest form of security is not stronger defense, it is the absence of threat. Eliminate the attack surface, and there is nothing left to breach.
Principle 02
Verify
Any security promise that cannot be independently verified is not a promise, it is a claim. Real security invites scrutiny.
Principle 03
Trustless
The best trust is the kind you never have to give. When a system proves itself by design, you don't need to trust anyone, not even us.
Security Measures
Research & Development
Security begins before the product exists, in how we write code and choose components.
01
Secure coding standardsMulti-layer code review processes established from day one.
02
Strict component selectionCC EAL5+/6+ certified secure elements chosen for proven tamper-resistance.
03
Signed firmware onlyAll firmware is cryptographically signed. Unsigned builds will not boot or run on any ELLIPAL device.
Authorized Production Control
Production Quality Control
Every device is produced under controlled authorization, the factory can only manufacture what we approve.
Batch-controlled, quantity-limited production
The factory can only manufacture devices that ELLIPAL has explicitly authorized. Each production batch has a fixed quantity cap and an expiration window; once either limit is reached, the production line stops, no additional units can be manufactured without a new authorization cycle from ELLIPAL.
Unauthorized production is impossible
Even with full access to materials and equipment, the factory cannot produce working devices beyond what we authorize. The system enforces hard limits on duplicate registrations, and any anomaly is flagged and blocked at the source.
Mutual verification, not one-sided trust
Authorization is not simply "the server says OK." Each device independently verifies the authorization it receives, using the same method as our server. If the result doesn't match, the device rejects it. The factory cannot forge an authorization, and the device won't blindly accept one. This is our trustless principle applied to the production line itself.
Anti-Tamper Hardware Design
Logistics & Delivery
Most hardware wallets rely on a tamper-evident sticker on the packaging. We don't, because every ELLIPAL device is tamper-evident at the hardware level, opening it destroys it. A sticker protects the box. Our design protects the device.
Screwless, Full-Metal Body
Milled from a single block of metal. Components are inserted from the front and sealed with the display. No screws, no seams, no entry points.
Globally sourced adhesive
2 months of testing — selected from a worldwide search, tested under constant-temperature, constant-humidity, and high-temperature conditions. Its melting point exceeds the touchscreen's thermal tolerance — by the time the adhesive softens, the screen is already visibly damaged.
Sealed construction
once assembled, the housing cannot be reopened without visible destruction. Opening it also triggers an automatic wipe of all private keys — the device becomes inoperable. Self-destruct on breach — environmental sensors (light, temperature) detect intrusion attempts and trigger an automatic wipe of all private keys. Even if a device is lost, your assets stay safe during the time window you need to move them to a new wallet.
Supply-chain / logistics attack
A device intercepted during shipping could be opened, implanted with a tracker or WiFi transmitter, and resealed — the user powers on, enters their PIN, and an attacker captures it without ever knowing. Our hardware design makes this physically impossible without leaving visible damage.
Threat Defended
How It Works in Your Hands
One Security System, Not Three Separate Products
ELLIPAL Titan 2.0 keeps your keys offline and signs transactions in complete isolation. ELLIPAL X Card lets you carry that same security on the go. ELLIPAL Seed Phrase Steel ensures your recovery seed survives anything. Each product exists because it solves a specific problem in the chain of asset protection, together, they form a complete security system.
ELLIPAL Titan 2.0
Pioneering the Air-Gapped Crypto Cold Wallet
Wallet Creation
Fully Offline Key Generation
No USB, no Bluetooth, no WiFi. Your private key is generated inside the CC EAL5+ secure element, a device that has never connected to any network, and never will.
2 Seed Sources + Passphrase
Choose your entropy: the hardware true random number generator (TRNG) inside the secure element, or import an existing BIP39 seed phrase. Add a passphrase for an additional layer of protection.
Passphrase, Your Ultimate Key
A passphrase can be any text you choose, a line of poetry, a personal phrase, up to ~100 characters of letters, numbers, and symbols. It creates a completely separate hidden wallet on top of your seed phrase. Even if someone obtains your 12/24 words, your assets remain invisible. The randomness is entirely yours, no device, no company, no one else is involved.
Private Key Stored in Secure Element
The secure element generates the random number, runs key derivation, and stores the resulting private key internally. The private key never leaves the CC EAL5+ secure chip.
Air-Gap Signing
Cross-Verification & Clear Signing
Your transaction intent is verified through multiple independent layers. No matter which part of the chain is compromised, the app, the network, or anything in between, any tampering with the transaction content will be caught and blocked before signing.
Titan's large touchscreen enables clear signing, every transaction is displayed in full, human-readable detail on the device: recipient address, amount, fee, and contract interaction. You never blindly sign a hash you can't read. And because this data is rendered on an air-gapped device that has never touched a network, what you see on screen is guaranteed to be what gets signed. No other connected screen can make that promise.
Password & Access Control
Pattern Setting, Multi-Account Access
Titan uses pattern-based unlock, and different patterns open different accounts. This means you can have a decoy account and a real account on the same device. Under duress, enter the decoy pattern; your real assets remain hidden and inaccessible.
Per-Account Transaction Password
Each account has its own independent transaction password, required every time you move assets. Even if someone gains access to the device, they cannot sign transactions without the correct password for that specific account.
Secure Keyboard, Randomized Layout
The on-device keyboard shuffles key positions every time. Repeated use leaves fingerprints and wear patterns on fixed-position keys, attackers have used thermal cameras and spectrometers to deduce passwords from these traces. A randomized layout eliminates this vector.
Auto-Erase on Wrong Pattern
Multiple consecutive incorrect unlock attempts wipe all data automatically. Combined with physical isolation, forced extraction becomes impractical.
No Biometrics, By Design
Fingerprints can be compelled. Faces can be scanned while you sleep. We chose passwords because they cannot be taken from you without your will.
ELLIPAL X Card
NFC Cold Wallet for beginners
Wallet Creation
Fully Offline Key Generation
No USB, no Bluetooth, no WiFi. Your private key is generated inside the CC EAL6+ secure element, a device that has never connected to any network, and never will.
2 Seed Sources + Passphrase
Choose your entropy: the hardware true random number generator (TRNG) inside the secure element, or import an existing BIP39 seed phrase. Add a passphrase for an additional layer of protection.
Passphrase, Your Ultimate Key
A passphrase can be any text you choose, a line of poetry, a personal phrase, up to ~100 characters of letters, numbers, and symbols. It creates a completely separate hidden wallet on top of your seed phrase. Even if someone obtains your 12/24 words, your assets remain invisible. The randomness is entirely yours, no device, no company, no one else is involved.
Private Key Stored in Secure Element
The secure element generates the random number, runs key derivation, and stores the resulting private key internally. The private key never leaves the CC EAL6+ secure chip.
Daily Signing
NFC Tap-to-Sign
Sign transactions with a physical NFC tap. The secure chip performs the cryptographic signing internally and transmits only the signed result, no private key data ever leaves the card during the process.
Cross-Verification & Clear Signing
Multiple independent verification layers ensure your transaction intent cannot be tampered with, no matter which part of the chain is compromised, any modification will be detected and blocked before signing. The ELLIPAL App displays every transaction in full, human-readable detail, recipient address, amount, fee, and contract interaction, so you always know exactly what you're signing before you tap your X Card.
In-App Secure Keyboard
The ELLIPAL App activates a randomized secure keyboard for PIN entry, preventing third-party keyboards or screen-capture malware from intercepting your input.
Security Safeguards
PIN: 6 to 16 Digits for NFC Signing
A single PIN is required for every NFC tap-to-sign transaction. 10 consecutive wrong attempts wipe the secure element. After 10 cumulative wipes, the card is permanently disabled, preventing unlimited brute-force attempts across resets.
No Biometrics, By Design
Fingerprints can be compelled. Faces can be scanned while you sleep. We chose passwords because they cannot be taken from you without your will.
Unique Advantage
No Firmware Upgrade Needed
The ELLIPAL X Card and its ELLIPAL X Card Starter are designed to function without any firmware updates. A device that cannot be changed cannot be compromised through change, this eliminates an entire class of attack vectors.
ELLIPAL Seed Phrase Steel
Paper dissolves. Steel doesn't
Why This Exists
The Problem No Device Can Solve
Both Titan and X Card ultimately rely on your seed phrase as the final backup. But how do you store it? Paper degrades, fades, and burns. Photos and digital copies create attack vectors. Your brain forgets. The Seed Phrase Steel exists because your backup deserves the same level of protection as your device.
Why We Insist on Seed Phrases
Some wallets remove the seed phrase entirely, we believe that's the wrong trade-off. A seed phrase you control means your assets are never locked into any single vendor, device, or service. It is the foundation of true self-custody.
Material & Specifications
Marine-Grade 316 Stainless Steel
Body and letter tiles are both marine-grade 316 stainless steel. Fire-resistant up to 1,454°C (2,649°F). Resists strong acid, flooding, impact, and crushing pressure. 70 × 57 × 6 mm, 130 g, compact enough to store in a safe, lock box, or hidden location.
BIP39 Compatible
Stores one 12/15/18/21/24-word seed phrase, or two separate 12-word seed phrases. Record the first four letters of each word using the included 280 stainless steel letter tiles. Compatible with nearly any BIP39 wallet, not just ELLIPAL. Built-in hole for padlock or tracker threading. No battery, no firmware, no maintenance.
Best Practice
Offline Only, Always
Assemble your letter tiles by hand. Never photograph, scan, or digitize your seed phrase. The Seed Phrase Steel exists precisely so your backup never touches a connected device.
Attack Defense
What ELLIPAL Defends Against
Different threats require different defenses. Here's how each product in the ELLIPAL system protects you.
| Attack Type | Way | ELLIPAL Cold Wallet |
|---|---|---|
| Remote / Network Attack | Hackers exploit wired or wireless connections to steal keys | ✓ |
| Supply-Chain / Logistics Attack | Device intercepted and tampered with during shipping before reaching you | ✓ |
| Physical Tampering / Evil Maid | Attacker opens the device to tamper with hardware or extract data | ✓ |
| Clipboard Hijacking | Malware replaces the recipient address when you copy-paste during a transfer | ✓ |
| $5 Wrench Attack / Coercion | You are physically forced to hand over your crypto | ✓ |
Guard Your Privacy
Never share your holdings publicly. Social media posts showing balances or wallet addresses have directly led to targeted attacks. Use a delivery address that isn't your home.
Recognize Phishing
We only contact you through our published official channels. Any email asking for your seed phrase, private key, or requesting you to "verify" your wallet is a scam, always.
Verify Addresses Before Sending
Clipboard-hijacking malware can silently replace the destination address when you copy-paste. Always compare the address on your hardware wallet's screen with the one shown in the app before confirming any transaction.
Protect Your Seed Phrase
Record it on your Seed Phrase Steel or paper, never store it digitally. Keep it in a secure physical location. If someone has your seed phrase, they have your assets, regardless of your hardware.
Diversify Storage
Don't put all your assets in one place. Distribute across multiple wallets and consider using different types of storage for different amounts, just like you wouldn't keep all your savings in one bank account.
Never Click Unknown Links
Phishing links are the most common way crypto gets stolen, fake DApps, airdrop scams, urgent "verify your wallet" messages. No matter how secure your hardware wallet is, clicking a malicious link and signing a transaction gives attackers permission to drain your assets. When in doubt, don't click.