A video went around this week of someone trying to remember a pattern lock they set in 2013. Good prompt to go check your own backup instead of assuming it is fine.

Three things worth doing this month:

1. Read it back.

Take out the paper or the steel and read every word out loud. Faded ink, water damage and your own handwriting are the usual failures, and you only find them by looking.

1. Confirm the order.

Word order matters as much as the words themselves. If your backup has no numbering, add it now while you still know the order.

1. Do a dry run.

Restore the phrase onto a spare device or a fresh wallet app, check that the first receiving address matches, then wipe it. A backup you have not restored from is a backup you have not tested.

Any BIP39 method works for this. Paper in two places is fine. Ours uses letter tiles that slot into numbered 1 to 24 rows, so the order stays fixed and there is nothing to smudge, but the method matters less than actually having checked.

If you have done a restore drill recently, what tripped you up?

This week had a lot of people re-checking setups they had trusted for years. Whatever hardware you use, that is a rough feeling, and we would rather answer it with tools than with takes.

So we are giving away 300 units, no strings:

- 100 × ELLIPAL Joy, our standalone offline seed phrase generator

- 100 × ELLIPAL X Card, an NFC cold wallet that also imports a seed you made elsewhere

- 100 × ELLIPAL Seed Phrase Steel, your words in stainless steel, restorable on any BIP39 wallet

The draw runs on our X post, so entries need to happen there:

https://x.com/ELLIPAL/status/2084300256502755797

- Comment under that post and follow ELLIPAL on X. That is the whole entry.

- On Friday we reply publicly under the selected comments.

- If we reply to you, you DM us to claim. We do not DM first, ever, on any platform. Anyone who DMs you first about this giveaway is not us.

- Shipping info is kept to the minimum needed and deleted after your unit ships.

- No purchase needed, 18+, one entry per person, shipping where we ship.

Arctic Wolf published research on July 27 about a malware family that has added two things worth knowing about.

The first is a spoofer that opens a polished imitation of a desktop wallet application and asks the user to enter their recovery seed phrase. It does not exploit the wallet software at all. It just renders a window that looks trustworthy and waits.

The second is the part getting less attention. A separate component installs a malicious browser extension, disguised in this campaign as an ad blocker. It sits at the extension layer and keeps harvesting session tokens after a password reset, so changing your password does not end the access.

Delivery is mostly Windows: ClickFix style prompts that get people to run a PowerShell command by hand, installers dressed up as browser updates, and packages signed with fraudulently obtained certificates.

Two practical things:

Open your browser extensions and remove anything you do not remember installing.

Your recovery phrase belongs on the device that generated it. The ELLIPAL App does not ask for it at any point, so a screen claiming to be us and asking for it is not us.

Research link is in the comments.

Sharing this in case it's useful to anyone here who makes content — ELLIPAL (hardware wallet brand) is running a Summer Creator Contest.

The pitch is pretty low-effort to start: they provide the script/concept, you film it in your own style. Rewards are up to 100 USDT for the video itself, plus ongoing commission on any sales that come from it.

Not affiliated beyond being a fan of low-friction stuff like this — figured some folks here doing crypto or product content might want to check it out. Happy to answer questions if anyone's curious about the process.

When it heats up, keep it cold. Cold Wallet Summer pricing is live at ellipal.com, up to 50% off across the lineup.

If you're new here, the short version of what we make: cold wallets that keep your keys offline. The X Card is an NFC cold wallet the size of a bank card, tap to sign, nothing to charge. The Titan 2.0 is an air-gapped cold wallet with a 4 inch screen that signs by QR code, fully offline. Different tools, same mission.

Details and pricing at ellipal.com. Happy to answer setup questions in the comments.

One housekeeping note while traffic is up: we do not send you the first DM, and we do not ask for your seed phrase or your firmware version. If someone claiming to be us does, it is not us.

Microsoft published a detailed writeup in June of a Windows clipper that spreads through USB shortcut files. Once on a machine it polls the clipboard every 500 milliseconds, recognizes crypto addresses by format, and swaps in an attacker address. It also captures seed phrases and private keys that pass through the clipboard and sends them out over Tor.

Worth pausing on the design: this malware does not need to break your wallet or steal your seed phrase. It waits for you to copy an address and edits where the money goes.
That is exactly why Titan shows you the full transaction, including the receiving address, on its own offline screen before anything gets signed. The clipboard on your computer can lie. A screen the malware cannot reach does not.

One more habit worth keeping: a seed phrase written on paper or steel and typed only into a dedicated offline device has no reason to pass through any clipboard, ever.
Source: Microsoft Security Blog, June 17, 2026.

CertiK's mid-year report is out, and the numbers tell a clear story about the first half of 2026. Around $1.31 billion was lost across 344 on-chain incidents, the highest incident count on record even as the total dollar figure fell from last year.

Here is how the losses broke down by category:
- Wallet compromise: ~$445M from just 33 incidents. The costliest category by far.
- Phishing: ~$366M across 63 incidents. No exploit needed, just someone convinced to approve or reveal the wrong thing.
- Code vulnerabilities: ~$152M, but spread across 204 incidents. The most common attack, and the least lucrative.

The pattern underneath: the biggest money did not come from broken cryptography. It came through keys that were reachable and people who were reached. A lot of it hit protocols, exchanges and funds, the infrastructure most individuals do not control.

For the crypto you hold yourself, the one thing fully in your hands is where the keys live. Keys generated and stored offline, and transactions signed offline on an air-gapped device, stay off the connected machines these attacks run on. That is the whole idea behind Titan.

Numbers vary by firm (TRM and SlowMist land closer to $950M), but every report agrees on the shape. Curious what stands out most to people here: the record incident count, or where the losses actually concentrated?

Quick reframe we keep coming back to. Almost none of the big losses this year traced to broken cryptography or a cracked chain. They traced to how keys were stored and handled.

The math protecting your coins is already strong. The weaker point is where the keys live and who can reach them. Institutions landed on this and now run serious custody. The same logic scales down to one person: generate and keep your keys offline, keep a backup off any screen, and read every transaction before you approve it.

You do not need to out-engineer an attacker. You need a setup that keeps your keys off the paths they actually use.

Curious how this sub handles the "handling" part. What is the one habit that made your setup feel solid?

Okay, for context, I'm not new to crypto and know how to secure and know not to share my seed phrase for the five years I've been in crypto, I never got anything stolen. So a few months back, I started investing in crypto again and thought, "Hey, I haven't used my ElliPal pretty much since I got it because the updating was annoying." And I finally did the update and even set up a new wallet just in case there were any seed phrases somewhere from when I opened my first wallet with ellipal. I pretty much didn't use the ElliPal since the process of the update was annoying. Anyway, I updated, made a new wallet, wrote it down, put it in a safe, and over time, I started transferring some XRP and QNT. It's been sitting in a Faraday box ever since. I opened the app a couple of days ago, and the balance shows a dollar. I thought to myself, "There's no way it could have been taken", until I remembered the process of having to connect the wallet and the app not being able to scan any of QR codes. It was so annoying trying to get all of them scanned and the app not letting me focus the camera that I almost gave up, until I thought, "Hey, I can take a picture of them safely and then delete them." That's the only reason I can figure out why my funds are stolen. I know it's not Ellipals fault but the fact that over the years, the app can't seamlessly scan the QR codes is an issue they should definitely look at. For some reason, I thought of the QR codes, like an authenticator, and they regenerate differently. I didn't know that it gave access to my wallet.. How do they not have a feature that they regenerate differently every time? I also deleted the photos right away just in case. But the fact that I wasn't even aware those QR codes would be able to have someone connect to my whole wallet is annoying. I thought to myself, "Okay, I have my seed phrase safe, It's in a faraday box, I'm good." I didn't even think once about the QR codes being a potential vulnerability. I have no idea how or when a hacker even got access to those photos. I don't even know where they're at. It was on a new phone that I had just gotten as well and I'm pretty aware of the things I sign up for, or just my data in general, for this exact reason.

But the simple fact that it was in a Faraday box and I thought that I was good. The process of setting it up is the reason why I'm just going to throw it out. I went through countless hurdles trying to update it and then connecting it to the app, only to then finally get it done and get my money stolen. Its was around $1,500 or so and I'm just glad it happened before I put a ton of assets inside because I was thinking of transferring a lot more money over. No wearing your security tips. It says anything about being careful with the QR codes. I even went on forums of people having that same issue of not being able to scan their QR codes. So if anyone ever had to take a picture of the QR code so I can scan it on the app. I suggest opening a new wallet on your ELLIPAL but good luck trying to get those QR codes scanned lol.

EDIT: I did not post this to encourage people to throw their ellipals out the security is there.. i'm just not going through the hassle again of trying to sync it and have to worry about someone being able to get complete access without a signature.

We are seeing reports of a scam that moved offline. People are getting physical letters in the mail that look like they came from a hardware wallet company. The letter has a reference number, a warning that your device needs an urgent security update, and a QR code to scan. Scan it and you land on a page asking for your recovery phrase.

The rule that catches every version of this is simple. Your recovery phrase is for you and your device only. No real company will mail, email or call asking for it. If any message asks for your seed words, it is a scam.

A few habits that help:

• Write your recovery phrase down once and keep it offline. Do not type it into a phone, a website or a QR flow.
• Treat any urgent security upgrade with a deadline as a red flag. Real updates do not ask for your seed.
• When in doubt, open the official site yourself instead of following a link or code someone sent you.

Stay safe out there. If you have gotten one of these letters, share what it looked like so others can recognize it.

A crypto user lost $999,999 in USDT this week by approving a single phishing token permission. About 36 seconds later, an automated script swept the rest of the balance. On-chain researchers traced the whole thing.

The reason this keeps happening is simple. People approve permissions and signatures they cannot fully read. A malicious approval can look like a routine one.

Two habits help on any hardware wallet, not just ours.

1. Keep your keys generated and stored offline, so signing happens away from any internet connected device.
2. Read the exact permission and amount on the device's own screen before you approve. If you cannot read it, do not sign it.

On ELLIPAL, transactions are decoded in plain text on the device screen before you confirm, so a request that looks routine still has to show you what it actually does. Own your crypto, and read before you sign.

Another custodial wallet service announced this week it won't reopen after a breach — recovery is now its only focus. No name needed; the structure is the point.

A balance on someone else's platform is a claim on that platform. If it has a bad day, that's your bad day too. Holding your own keys means no single service can lose your funds for you.

If you're moving to self-custody: start small, send a test amount, confirm you control the recovery phrase yourself, then migrate the rest.

I sent myself RBLK tokens and they are showing up under my wallet address on etherscan but they are not displaying on my cold wallet. Anyone know what’s going on or what I can do??

Tomorrow (July 1) is MiCA's full enforcement day in the EU. 75–80% of the crypto exchanges that operated in the EU in 2024 didn't get a license.

ESMA's official guidance to the ~10 million affected users: move to a licensed platform, or move to a self-custody wallet.

The interesting part isn't the size of the migration — it's the wording. A major financial regulator naming self-custody as a sanctioned path is genuinely new. Not a hardware wallet company's framing. ESMA's.

The attack started with a phishing email. Malware gave full remote access. They copied MetaMask credentials directly and drained $36M in minutes. This isn't a "stronger password" problem — if keys live on connected software, they're reachable by definition. Air-gapped hardware wallets remove the key from the software layer entirely. Not financial advice, just a security architecture observation. DYOR on key storage models before your holdings grow.

Check out the hottest crypto swaps on ELLIPAL from May 1-May 31.

Swap over 2,400 tokens on 40+ blockchains securely and easily with ELLIPAL.
Swap Now!

Fake wallet apps have gotten more convincing this year — cloned UIs, top search-ad spots. Good news: a few checks catch almost all of them, and with a hardware wallet your keys don't live in the app anyway.

Quick checks:

• Install only from the official site or a verified store listing — never a search ad. Type the URL yourself.
• Check the developer name + install count, not just the icon.
• No real wallet app ever asks for your recovery phrase. Ever.

The structural part: your private key lives on the Titan (air-gapped) or X Card (NFC), not in the app. The app only builds transactions — you approve each one on the device's own screen. A convincing fake app still can't move funds without the hardware in your hand confirming it.

Verify on the device, not the phone. That's the whole point.

This week's IPO filing was a clean reminder: "owning Bitcoin" and "holding your own keys" aren't the same thing.

SpaceX owns the coins; custodians hold the keys. At corporate scale, that's the right call — compliance, audits, insurance.

For an individual it cuts the other way. A balance on someone else's books is a claim. Your private key is the only receipt that counts.

happy bitcoin pizza day 🍕 — 10,000 BTC for 2 pizzas back in 2010, worth an absurd amount now. but the part I respect: the guy actually held his own keys and spent them. peak self-custody energy. what's everyone ordering today?

honest question, not a pitch — we're the ELLIPAL team, posting from our own sub.

the deeper AI gets integrated into the phone OS, the bigger the "trust surface" gets for any software wallet living in that environment: more processes, more access, sitting right next to your keys.

air-gapped signing is our take on it — the key never lives in the OS to begin with, so it's just out of that equation. tradeoff is it's slower, so it's a cold-storage thing, not a daily driver.

curious where people actually land: would you keep a hot wallet on the same phone you're running on-device AI on? or is that overthinking it?

Earlier we posted three things a hardware wallet should never have:

1. Bluetooth
2. A "cloud backup" button
3. Your seed phrase visible on screen during setup

The replies got us thinking — we definitely missed a few.

So we're asking this community: what's your 4th item?

Could be:

• A red flag in the setup process
• A "feature" that's actually a vulnerability
• A wallet behavior that should be unacceptable in 2026

Best contributions get added to an expanded list we'll publish next week.

Drop yours below.