ELLIPAL

Own your crypto. Your way.
Air-gapped cold wallets and NFC cards. No exchange in the middle.

No TG, DC, FB groups or other X accounts.

[ELLIPAL @ELLIPAL]

ELLIPAL's Answer to Supply Chain Attacks, built layer by layer since 2018:

- Hard to open, built to show it
- Designed to wipe data if forced open
- Seed phrase made offline in the secure chip

Our team ran onsite tests, here is what happened:
https://t.co/ERbA8w8kjv

[ELLIPAL @ELLIPAL]

Already have a seed phrase? ELLIPAL X Card supports it.

Import it through the offline Starter, or generate a new one with the card’s secure chip.

Battery-free NFC. Set up in 3 minutes.

https://t.co/aLdDkwgMge

[ELLIPAL @ELLIPAL]

@criptopaul Useful breakdown. For self-custody the practical part is short: a hacked site can show a fake address or a fake prompt, so treat any website asking for your seed phrase as a red flag and check what you're signing on the device itself.

[ELLIPAL @ELLIPAL]

@martypartymusic Self custody holds up best when the basics are routine: seed phrase kept offline, the address checked on your device before you sign, and a small test send for anything new.

[ELLIPAL @ELLIPAL]

Worth repeating: a compromised site can look exactly like the real one.

No website needs your seed phrase. If one asks, leave.

Before you sign, check the address on your wallet, not just on the page.

[CZ 🔶 BNB @cz_binance]

Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.

Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early.

Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits.

Stay SAFU!

[ELLIPAL @ELLIPAL]

Custody is a valid choice. But the trade-off is clear: someone else holds the keys.

Self-custody means you control the keys. You also take responsibility for the backup.

We build for those who choose both.

[ELLIPAL @ELLIPAL]

Coinbase will convert any GYEN still on the platform to USDC from Oct 26.

Its own notice says: to keep it as GYEN, move it to a self-custody wallet before then.

Check your wallet supports GYEN on the same network before you send.

See full breakdown:
https://t.co/GsjgdvyByS

[ELLIPAL @ELLIPAL]

See what you’re signing. Then decide whether to sign.

That’s what ELLIPAL Titan 2.0 lets you do.

[ELLIPAL @ELLIPAL]

Seed phrase backup: paper or steel?

Our pick: steel, plus a second offline copy in a different place.

[ELLIPAL @ELLIPAL]

Fair point, our firmware is closed. Open source shows you the code, not what runs on your device. This summer a wallet with public code generated weak seeds for years.

What you can check: standard BIP39 seeds you can bring yourself and restore elsewhere.

Pick the setup you trust more.

[ELLIPAL @ELLIPAL]

Same lure: a fake alert, then a box for your seed phrase.

This hurts everyone who holds their own keys, whichever wallet they use.

If any alert, banner or message asks for your seed phrase, don't enter it.

[Nick Percoco @c7five]

Second wallet maker in two days whose own app notifications were used to phish seed phrases. SecuX, now NGRAVE.

The lure: your wallet just synced on a Pixel 9 in Moscow. Fear first, then a box for your 24 words.

The only time you type your seed is when you chose to restore a wallet. Never because an alert told you to.

[ELLIPAL @ELLIPAL]

@Timesly The multisig crowd in our replies is growing🙌 I can say this thread has got forwarded to the product team.

[ELLIPAL @ELLIPAL]

@18wheelerpusher @moonpay Hi, the account replying above isn't part of the ELLIPAL team. Whatever the intent, please don't go to DMs or Telegram with them or use their links or recovery services.
A seed phrase is for its owner alone, whoever asks for it. Official support: [email protected] or @ELLIPAL.

[ELLIPAL @ELLIPAL]

Swap across chains from cold storage.

@moonpay Trade is in the ELLIPAL App.
Tap to sign with ELLIPAL X Card:
https://t.co/fTZOOBkUSg

[ELLIPAL @ELLIPAL]

@pitjuan08 Thanks for flagging this. You're right that impersonators gather under our posts, and we report them as we find them. For help, please use [email protected] or reach us here on @ELLIPAL.

[ELLIPAL @ELLIPAL]

@AdeelBaloch71 @CryptoAwaz Congrats! And enjoy your self-custody journey😎

[ELLIPAL @ELLIPAL]

Can your phone replace a hardware wallet?

Phone chips store keys well. The gap is the rest of the phone: apps, links and a live connection.

A hardware wallet keeps your keys on a device that only signs.

See full breakdown:
https://t.co/nKzPupAZar

[ELLIPAL @ELLIPAL]

If anyone gives you a wallet to import, the keys are already theirs.

A seed phrase or wallet QR code from a website, a DM or a "support" account works the same way: whoever made it can move the funds.

Create a new wallet on your own device instead.

[ELLIPAL @ELLIPAL]

New hardware wallet in the mail.
The first thing you look at: ____

[ELLIPAL @ELLIPAL]

Holding your own keys should stay a private choice.

A register of who holds what cuts against the reason people choose self-custody.

[Lark Davis @LarkDavis]

Under consideration in France right now:

• Crypto-to-stablecoin swaps become taxable

• €800k+ portfolio exit tax if you try to leave

• Mandatory reporting on self-custody wallets over €100k

A centralized government registry of who holds what, right after tax office data leaks and while streets are in full unrest. What could possibly go wrong with home invasions?

[ELLIPAL @ELLIPAL]

@UniverseTwenty Signing over QR from an offline device is a sensible pattern.
What makes it work is discipline: keep that phone offline after setup, and check the address, amount or call details on its screen before you approve.

[ELLIPAL @ELLIPAL]

@WorldOfMercek Rough week for everyone who holds or builds these devices. Incidents like this hurt trust across the whole industry, and every maker is on the same side: user safety comes first.
Thanks for walking people through it calmly.