NexFlow › Is Ellipal safe

Is Ellipal safe? The 'fully air-gapped' wallet a lab extracted in an afternoon

Ellipal's file is the cautionary shape in the hardware family: a device marketed as fully air-gapped that Ledger's Donjon lab opened like a phone — UART re-enabled, flash dumped, encrypted keys brute-forced in minutes because the only thing protecting them was the user's password. The Titan redesign answered part of it, the closed firmware answers none of it, and the incident repriced what 'air-gapped' is allowed to mean.

Updated September 28, 2026 · By the NexFlow editorial desk · Sources linked throughout; vendor claims labeled.

What Ellipal is

Ellipal makes air-gapped hardware wallets — the original EC-01 (2018) and the Titan line — that communicate exclusively by QR code: no USB data, no Bluetooth, no cellular, no NFC. The Titan is a sealed metal slab with a four-inch touchscreen and a camera, firmware updates delivered by microSD through a separate adapter, and support for dozens of chains with in-app swaps. The marketing claim is the strongest in the class: a device with literally no network interface can't be remotely attacked.

The architecture underneath is the contested part. The EC-01 was, in Ledger Donjon's assessment, essentially a low-end Android device with the radios software-disabled rather than absent — and no secure element at all, leaving the user's password as the only thing between an extracted flash image and the private keys. Titan 2.0 claims a CC EAL5+ chip and removes the connectivity hardware entirely; the firmware remains closed-source, which is the line every critical review lands on.

The Donjon teardown

Ledger's Donjon lab examined the EC-01 and published findings that read like the air-gap's obituary for that generation: the UART debug interface could be re-enabled, giving bootloader access; the flash could be dumped wholesale — which simultaneously enabled full firmware reverse-engineering and exposed every user's encrypted private keys. The encryption itself was flagged: update files protected in ECB mode ('definitely not good practice', in Donjon's words), and WiFi found to be merely software-disabled on hardware that carried the capability.

The kill shot was the password layer: extracted xpriv keys were protected by a salted SHA-256 check that permitted efficient brute force — Donjon estimated a random 8-character password falls in minutes on a desktop computer. An attacker with brief physical access — supply chain, evil maid — could backdoor the device or extract and crack the keys. No remote exploitation was demonstrated, and no user theft was ever tied to the work; but the 'air-gapped' claim collapsed to 'air-gapped until someone solders two pins'.

What the Titan changed

Ellipal's response was the constructive half of the file: it paid out on its bounty clause, presented the exchange at the 2019 Breaking Bitcoin convention, and redesigned for the Titan — removing the UART and USB data paths entirely (charge-only USB), sealing the body, and claiming an EAL5+ secure chip for the Titan 2.0 generation. The documented vulnerabilities are a first-generation file; the Titan has not had a comparably damaging public teardown.

The unclosed parts are structural rather than incident-shaped. The firmware stays closed-source — buyers cannot verify what the device does, and the company's marketing record invites the scrutiny (its claim to have 'created the first air-gapped cold wallet' postdates Coinkite's shipping Mk1). In-app swap and earn features introduce a custodial counterparty window the air gap does nothing for. And the no-network claim, once shown to be a software switch on the EC-01, now rests on trusting the Titan's teardown claims that no one outside the company has verified at the same depth.

The honest read

The Ellipal file is the counter-argument to 'air-gapped means sealed': the gap is a transport property, not a hardware-integrity property — a QR channel does nothing against a device whose flash can be dumped, whose password can be cracked in minutes, and whose radios existed in silicon. The Titan addressed the demonstrated holes, which is more than some vendors manage; but the trust model it asks for — closed firmware, company-verified security claims, a bounty history whose famous entry is a competitor's lab breaking the product — is the weakest in the hardware tier.

Positioned against the field: Ledger and Trezor both have documented extractions or breaches but verifiable counterweight (certified SE, open firmware respectively); Coldcard and BitBox02 offer reproducible builds and disclosure histories; Jade opens everything. Ellipal asks the buyer to trust the redesign — which may well be real, and simply cannot be independently checked.

If you already own one

For an existing Titan owner the file translates into a short checklist rather than a panic. The demonstrated attacks were all physical — supply chain or stolen-device scenarios — which means the device's worst-case surface is a person holding it, not the internet. The mitigations that matter: a long, high-entropy password/passphrase is the actual key-strength layer (the EC-01's brute-force finding is the reason 8 characters is a floor, not a target); buy only from Ellipal directly, because a tampered unit is the one attack the air gap does nothing about; and verify update packages with the published verification tool before the microSD ever touches the adapter.

And the honest upgrade note: the reasons to move off the platform are not that it was broken — patching happened — but that everything about the fix is unverifiable. If the threat model is ordinary loss and theft, a current Titan with a strong passphrase is a reasonable device. If the threat model is the one the Donjon report actually tested, the verifiable-firmware alternatives exist for a reason — and the EC-01 file is the evidence that trust-the-vendor can fail silently for years before a lab publishes why.

Where Ellipal stands

In the hardware tier, Ellipal is the trust-the-vendor pole: the only major device whose flagship security property is asserted rather than verifiable, and whose incident file contains the category's cleanest physical extraction. The air-gap is real as a remote-attack defense — nothing here was ever reachable over a network — but the Donjon work established that 'air-gapped' and 'tamper-resistant' are different axes. For a buyer who wants QR-signing UX and multi-chain breadth and accepts closed-firmware trust, the Titan is a functional device with a patched record; for a buyer whose threat model includes the supply chain or the lost-suitcase scenario, the verifiable alternatives exist precisely because this file exists.

Frequently asked questions