ELLIPAL's Answer to Supply Chain Attacks, built layer by layer since 2018:
- Hard to open, built to show it
- Designed to wipe data if forced open
- Seed phrase made offline in the secure chip
Our team ran onsite tests, here is what happened:
ellipal.com/blogs/security-r…
Already have a seed phrase? ELLIPAL X Card supports it.
Import it through the offline Starter, or generate a new one with the card’s secure chip.
Battery-free NFC. Set up in 3 minutes.
youtube.com/shorts/NwzUoGUwF…
Worth repeating: a compromised site can look exactly like the real one.
No website needs your seed phrase. If one asks, leave.
Before you sign, check the address on your wallet, not just on the page.
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.
Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early.
Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits.
Stay SAFU!
Coinbase will convert any GYEN still on the platform to USDC from Oct 26.
Its own notice says: to keep it as GYEN, move it to a self-custody wallet before then.
Check your wallet supports GYEN on the same network before you send.
See full breakdown:
ellipal.com/blogs/guides-com…
Same lure: a fake alert, then a box for your seed phrase.
This hurts everyone who holds their own keys, whichever wallet they use.
If any alert, banner or message asks for your seed phrase, don't enter it.
Second wallet maker in two days whose own app notifications were used to phish seed phrases. SecuX, now NGRAVE.
The lure: your wallet just synced on a Pixel 9 in Moscow. Fear first, then a box for your 24 words.
The only time you type your seed is when you chose to restore a wallet. Never because an alert told you to.
Can your phone replace a hardware wallet?
Phone chips store keys well. The gap is the rest of the phone: apps, links and a live connection.
A hardware wallet keeps your keys on a device that only signs.
See full breakdown:
ellipal.com/blogs/security-r…
Holding your own keys should stay a private choice.
A register of who holds what cuts against the reason people choose self-custody.
Under consideration in France right now:
• Crypto-to-stablecoin swaps become taxable
• €800k+ portfolio exit tax if you try to leave
• Mandatory reporting on self-custody wallets over €100k
A centralized government registry of who holds what, right after tax office data leaks and while streets are in full unrest. What could possibly go wrong with home invasions?
This weekend, many asked if a phone can replace a hardware wallet.
Our view: let the phone run the app, and keep your keys on a separate device.
On ELLIPAL Titan 2.0, you check each transaction on the device's own screen, and it signs offline.
❓What's your setup?
🤖 Made with AI
Swap across chains from cold storage.
@moonpay Trade is in the ELLIPAL App.
Tap to sign with ELLIPAL X Card:
ellipal.com/pages/ellipal-x-…
Our week in self-custody:
Oct 13 · A Starter tamper test, on video
Oct 14 · How we build hardware against supply chain attacks
Oct 15 · Where September's hack losses happened
Oct 16 · Three checks before you set up a new wallet
Thanks for every question in the replies.
Some ask if cold storage still makes sense after the latest supply chain attack.
Our view: it does.
The attack reportedly needed a wallet opened before it reached its owner. That's why checks at unboxing matter as much as the hardware.













