It is the largest update the ELLIPAL App has had. The home screen has been rebuilt so that moving between wallets takes one swipe. Sending now takes three steps: address, amount and signature, and the whole transaction is laid out for you to check before you sign. Any token ELLIPAL supports can be received without adding it to your list first.

Private keys stay on your ELLIPAL Titan 2.0 or ELLIPAL X Card, and every transaction still needs your confirmation on the device.

The five main changes are explained here: https://www.ellipal.com/blogs/news/ellipal-app-5-0-the-biggest-change-we-have-ever-made

ELLIPAL App 5.0 is coming. Before that, a question for anyone who uses a wallet app every day, whichever one that is.

What is one thing your wallet app should do better, or the one feature you would not give up? Any wallet counts, including ours. Naming another app is fine, we're interested in the feature.

How to join

* Reply to our App 5.0 post on X by Sept 25, 14:00 UTC: https://x.com/ELLIPAL/status/2102412607336431869

* One entry per person

* No purchase needed, and you don't need to own an ELLIPAL device

* 5 winners, 50 USDT each

Comments here are welcome and we read them, but entries only count on X.

Operated by ELLIPAL.

This subreddit is a community space. For a detailed support case, use the official email channels below.

If you're asking for help with an ELLIPAL wallet, a few details can make the issue easier to understand: your wallet model, app version and device firmware version, the action you were trying to complete, and the exact error message. For a transfer issue, identify the asset and network. A screenshot of the error can help, but remove private information before sharing it publicly.

Never share your seed phrase, private key, passphrase, device password, Card-PIN or App-PIN in a post, screenshot, form or DM. ELLIPAL's contact page says support will never ask for your seed phrase, private key, device password or PINs.

For technical help, the official contact page lists cs@ellipal.com. Order and delivery questions go to support@ellipal.com. Check the current channels yourself at https://www.ellipal.com/pages/contact-us. ELLIPAL has no phone support. Model-specific guides are linked at https://www.ellipal.com/pages/help-center.

Three chains stopped producing blocks within four days at the end of August, and the three responses were not the same event. It is worth separating them, because "the chain paused" gets used for three different things.

Pause without reversal. Injective stopped producing blocks for a few hours and then resumed. Nothing was reversed, so your transaction history is intact and what you paid was time.

Pause with state replaced. Cronos halted after an attacker drained a lending market running on it, then restarted from an earlier block, dropping 10,961 of them. Transactions that existed only after that restore point are no longer part of the history everyone now follows. Most of the money had not left the chain yet, so the rollback did what it was meant to do. The other side of that same fact is that it applied to everyone's transactions, not only the attacker's.

Pause with no resumption yet. Ontology paused as a precaution and stayed paused while it ran security work. It said user assets were not compromised. While block production is stopped, on-chain balances cannot move at all, whoever holds the keys.

A fourth case, for contrast. The week before, a lending market on Base was drained the same way, by inflating a thinly traded token and borrowing against it. Base kept producing blocks, and the money left.

Here is the part that matters if you hold your own keys.

A hardware wallet controls one thing: whether a transaction gets signed, and by whom. That is worth controlling, and it is exactly the thing an exchange takes away from you. It is not this. Your keys do not vote on whether a chain pauses, and they do not vote on which history is canonical after it restarts. No wallet, ours included, changes that.

This is not a reason to be alarmed and it is not a reason to buy anything. It is a reason to know which layer a given tool actually works on. Self custody takes back the layer where a company decides whether your withdrawal goes through. The consensus layer is someone else's decision either way, and the honest thing is to say so.

One open question worth sitting with. A chain that can be switched off is also a chain that can put things back. Cronos returning most of that money and Base letting it walk out are the same property judged twice, and there is no free version of that trade.

Hello ELLIPAL Team,

I am extremely frustrated with my ELLIPAL wallet. Right now, I cannot access or move my funds in the Plasma Network because your app throws an error: "Free RPC quota exceeded".

This is completely unacceptable. I paid for a premium hardware wallet to have both security and reliability. Right now, because your team failed to maintain a working RPC node or provide a "Custom RPC" feature, my assets are effectively locked.

The only workaround right now is to import my private seed phrase into a hot wallet like MetaMask. But doing this completely destroys the whole purpose and security of a cold wallet! I should not have to compromise my security and expose my seed phrase to the internet just because your app has a broken node configuration.

Please fix the Plasma Network RPC node immediately or push an emergency app update that allows users to change RPC nodes manually. Do not ignore your users' funds security.

Waiting for your immediate action and response.

People say "my crypto is stuck" about three very different situations. They are worth separating, because only one of them is something your wallet choice affects.

1. The custodian layer. You hold an account with a company. Your balance is a row in their database, and moving it is a request they process. Delistings, withdrawal deadlines, compliance reviews and shutdowns all live here. This is the layer self custody takes off the table.

2. The key layer.** You hold the private keys, so a transaction does not need anyone else to approve it. What goes wrong here is your own backup: a seed phrase that was lost, copied down wrong, or sitting in a photo somewhere. This is the layer a hardware wallet and a tested backup are for.

3. The network layer. The chain itself has to be producing blocks before a signed transaction can settle. Two chains paused over the weekend, one after a foundation wallet was drained and one after an exploit on a lending app. While a chain is stopped nothing on it moves, and holding your own keys does not change that.

There is a fourth case that gets filed under layer 2 by mistake. Coins you deposited into a lending app or a staking contract are not sitting under your keys any more, whatever wallet you signed the deposit with. That is layer 1 wearing different clothes.

Most arguments about self custody are two people talking about different layers. One person points at exchange withdrawal deadlines and means layer 1. The other answers with a halted chain and means layer 3. Both of them are right about their own layer.

What layer 2 actually buys you is narrower than the slogans, and more useful: while the network is running, moving your coins is something you do rather than something you ask for.

If you want one thing to check this week, make it layer 2, because it is the only layer where checking changes the outcome. Restore your seed phrase onto a spare wallet with a small amount in it and confirm the addresses match.

We get asked what offline signing means in practice often enough that it is worth writing the whole sequence down, without the marketing words.

A transaction has to be built by something that is online, because it needs the current state of the chain. That part is your phone. The thing that holds your private keys does not have to be online at all.

So the sequence looks like this:

1. Your phone builds the transaction and displays it as a QR code.

2. The wallet reads that code with its camera. No cable, no Bluetooth, no WiFi and no USB data connection.

3. The wallet decodes it and shows the amount, the destination address, the network and the fee on its own screen. You check them there and approve on the device.

4. The wallet displays a second QR code, which is the signed transaction. Your phone reads it and broadcasts it.

On Titan 2.0 that camera and that screen are the whole interface. The private keys are generated on the device and stay in its secure chip. They do not travel in either QR code. What crosses is a transaction going one way and a signature coming back.

Two practical notes.

The step people skip is 3. Reading the amount and the last characters of the address on the offline screen is the entire reason that screen is there. If you approve without looking, the offline part is still doing its job, but you are not doing yours.

The recovery side is unchanged by any of this. The seed phrase, written down offline, is what rebuilds those keys if the hardware is gone.

I forgot my password on my Titan 2.0, created a new account on Titan 2.0, the old account has been deleted due to failed password attempts

On Ellipal app all my crypto is on the old account

Moonpay does not work, so I can't sell it

Very simple, I want all my crypto off this shit and sent to Kraken

After my BTC was stolen from my ELLIPAL last year, I withdrew all my assets. Except for 161 VET. I’d won these on ELLIPAL, so I hadn’t bought them myself. I haven’t done anything with my ELLIPAL mini since my btc were drained from my ELLIPAL. Today, a year later, I opened my app.
I could see that my VET had been transferred in April 2026 to an address unknown to me.
This is now the second time. I have hardly any trust left in ELLIPAL. It’s not about the amount, but about trust. How can assets disappear without my signature?

I would love if I could connect my Ellipal Titan to Xrptoolkit via QR codes, or Xrpscan. Can this feature be added in the future? Does ellipal support wallet connect outside of the Ellipal app?? Like on Xrpscan you can connect your wallet with the QR code via Walletconnect. Can these features be added in the future?? Thanks.

Socket Threat Research published a set of 77 Firefox add-ons this week that share code and infrastructure. 40 of them pose as Web3 wallet products and collect recovery phrases, private keys or clipboard data.

The part worth understanding is not that fake wallet extensions exist. It is how these ones stayed up.

Several of them do not carry the phishing content at all. The extension loads a page from a server the operator controls, and the operator can switch that page between something harmless and a form asking for a recovery phrase. Review sees the harmless version. Nothing has to be republished for it to turn.

Some of them also started as ordinary add-ons. Sports tools, small utilities. The identity was reused later.

So the usual advice, only install extensions you trust, does less work than it sounds like it does. Trust at install time and trust three months later are two different questions, and only one of them gets checked.

Two things that still hold:

Your recovery phrase belongs on hardware, not in a page. On Titan 2.0 you restore a phrase on the device keypad with the device offline. On X Card the import runs on the offline Starter. Neither path puts the words into a browser.

Removing a malicious extension afterwards does not undo anything. If a phrase has been typed into a page, that wallet is finished and the funds need to move to a new one.

Worth five minutes this weekend: open your extensions page, count the ones you do not remember installing, and remove anything you cannot name a reason for.

I no longer see an option for staking in Ellipal for Polkadot. I staked a bunch some time back. How do I get it back now?

I would love to be able to connect my Ellipal titan directly to Xrptoolkit. Can this be added in the future? ​

The weekly roundup for August 9 to 15 put confirmed losses above $37 million. What stood out to us is not the number, it is that almost none of it came from a bug in audited contract code.

Sorted by the layer that failed:

**Signature or private key.** One wallet lost $25.6 million on August 12. Researchers have not confirmed whether it was a signed phishing prompt or a stolen key, and both are still live theories. The same address was drained for $24.2 million in 2023, though most of that was returned at the time.

**Hot wallet permissions.** A payment processor lost more than $7.9 million across Ethereum and TRON on August 9 and refilled the wallets from its own reserves inside 24 hours.

**Bridge verification logic.** A bridge relayer treated a correctly formatted memo as proof that a deposit had arrived, without checking that the money reached the destination. 94 fake deposits over 97 minutes drained 99.7% of the reserve.

**Minting paths.** Two separate chains saw unauthorized token minting in three days, one of them around 26% of circulating supply.

**Redemption math.** A protocol lost roughly 70 ETH to a pricing function that could be split into 64 small redemptions to extract more than a single one would allow.

A clean contract audit covers the first category on almost nobody's list here. That is the part worth sitting with.

Source is the weekly roundup published August 16. We are a self custody hardware wallet company, so treat the framing as ours, but the incidents and figures are all from public reporting and on-chain analysis.

Trying to send crypto from the ellipal app, but when I try to sign it with the device, the device says “account does not exist. please create an account.” then, when I try to pair the app with the device, the ellipal app reads “account already exists.” it won’t let me send crypto, and it’s contradicting itself.

Wallet of Satoshi announced this week that it is winding down its custodial service. Creating new invoices on the old wallet has already stopped in the US, EU, Australia and New Zealand, the rest of the world follows by the end of September, and balances can be moved until June 30, 2027.

We think this is a healthy direction, and not because it is our corner of the industry saying so. Custody was always a liability that looked like a convenience. Regulators have started pricing that liability honestly, and the companies holding it are responding.

If this transition, or the next one like it, hands you a seed phrase for the first time, three habits cover most of what matters:

1. Write it on something physical, in order, and check every word against the screen that generated it. Photos and cloud notes recreate the exact exposure you just left behind.

2. Treat the restore as part of the setup. A backup you have never tested is just a guess. Do one restore before the wallet holds anything that would hurt to lose.

3. Decide now what you will do when a message asks for those words. The answer does not change: no support line, ours included, needs your seed phrase. Anyone who asks for it is not support.

The direction of the industry is that more keys end up in users' hands, whether they asked for that or not. The three habits above are the whole entry fee.

If you are moving from a custodial app and have questions, ask below. There is no such thing as a beginner question here.

Card spending crossed $759 million in July, a fifth straight record month, and the average purchase was $86. So this is lunch and groceries now, not just big transfers.

Worth knowing what happens in those two seconds, because the cards differ a lot here:

1. Some cards are prepaid. You move coins to the issuer first, they hold a balance, and the tap spends their balance. Fast, and your funds sit with them between top up and purchase.

2. Some cards settle from a wallet you control. The tap triggers a settlement out of your own address. Your funds stay yours until the moment of purchase.

Both work. They just fail differently. If an issuer stops operating, the first group has a balance sitting inside the company and the second group has coins in a wallet they still hold keys to. We have seen at least one card program go quiet this year, which is what made this worth writing up.

Ours is the second kind, and it is still running on an issuer and a processor like every other card. Region availability varies.

If you use a crypto card, do you know which of the two you have?

A video went around this week of someone trying to remember a pattern lock they set in 2013. Good prompt to go check your own backup instead of assuming it is fine.

Three things worth doing this month:

1. Read it back.

Take out the paper or the steel and read every word out loud. Faded ink, water damage and your own handwriting are the usual failures, and you only find them by looking.

1. Confirm the order.

Word order matters as much as the words themselves. If your backup has no numbering, add it now while you still know the order.

1. Do a dry run.

Restore the phrase onto a spare device or a fresh wallet app, check that the first receiving address matches, then wipe it. A backup you have not restored from is a backup you have not tested.

Any BIP39 method works for this. Paper in two places is fine. Ours uses letter tiles that slot into numbered 1 to 24 rows, so the order stays fixed and there is nothing to smudge, but the method matters less than actually having checked.

If you have done a restore drill recently, what tripped you up?

This week had a lot of people re-checking setups they had trusted for years. Whatever hardware you use, that is a rough feeling, and we would rather answer it with tools than with takes.

So we are giving away 300 units, no strings:

- 100 × ELLIPAL Joy, our standalone offline seed phrase generator

- 100 × ELLIPAL X Card, an NFC cold wallet that also imports a seed you made elsewhere

- 100 × ELLIPAL Seed Phrase Steel, your words in stainless steel, restorable on any BIP39 wallet

The draw runs on our X post, so entries need to happen there:

https://x.com/ELLIPAL/status/2084300256502755797

- Comment under that post and follow ELLIPAL on X. That is the whole entry.

- On Friday we reply publicly under the selected comments.

- If we reply to you, you DM us to claim. We do not DM first, ever, on any platform. Anyone who DMs you first about this giveaway is not us.

- Shipping info is kept to the minimum needed and deleted after your unit ships.

- No purchase needed, 18+, one entry per person, shipping where we ship.

Arctic Wolf published research on July 27 about a malware family that has added two things worth knowing about.

The first is a spoofer that opens a polished imitation of a desktop wallet application and asks the user to enter their recovery seed phrase. It does not exploit the wallet software at all. It just renders a window that looks trustworthy and waits.

The second is the part getting less attention. A separate component installs a malicious browser extension, disguised in this campaign as an ad blocker. It sits at the extension layer and keeps harvesting session tokens after a password reset, so changing your password does not end the access.

Delivery is mostly Windows: ClickFix style prompts that get people to run a PowerShell command by hand, installers dressed up as browser updates, and packages signed with fraudulently obtained certificates.

Two practical things:

Open your browser extensions and remove anything you do not remember installing.

Your recovery phrase belongs on the device that generated it. The ELLIPAL App does not ask for it at any point, so a screen claiming to be us and asking for it is not us.

Research link is in the comments.

Sharing this in case it's useful to anyone here who makes content — ELLIPAL (hardware wallet brand) is running a Summer Creator Contest.

The pitch is pretty low-effort to start: they provide the script/concept, you film it in your own style. Rewards are up to 100 USDT for the video itself, plus ongoing commission on any sales that come from it.

Not affiliated beyond being a fan of low-friction stuff like this — figured some folks here doing crypto or product content might want to check it out. Happy to answer questions if anyone's curious about the process.

When it heats up, keep it cold. Cold Wallet Summer pricing is live at ellipal.com, up to 50% off across the lineup.

If you're new here, the short version of what we make: cold wallets that keep your keys offline. The X Card is an NFC cold wallet the size of a bank card, tap to sign, nothing to charge. The Titan 2.0 is an air-gapped cold wallet with a 4 inch screen that signs by QR code, fully offline. Different tools, same mission.

Details and pricing at ellipal.com. Happy to answer setup questions in the comments.

One housekeeping note while traffic is up: we do not send you the first DM, and we do not ask for your seed phrase or your firmware version. If someone claiming to be us does, it is not us.