Trading Education Platform SystemSubscribe for FreeSupport
Wallets / Ellipal Titan 2.0
HARDWARE WALLET REALITY CHECK · READ 11 OCT 2026

Ellipal Titan 2.0: what the sources say

Current 1 disclosed weakness 2 company incidents

Key facts

The questions, with sources

QuestionWhat the sources saySource
Status
Current — Official store lists Titan 2.0 with buy/add-to-cart on 2026-10-11 (EUR 149 on Italian page, USD 169 on English page). The Titan 2.0 launch post does not say whether it replaces the original Titan. Model name matches the current lineup (Titan 2.0, Titan Mini, X Card).
Company
ELLIPAL
List price
€149 / $169 — Italian store page shows EUR 149 (with struck-through EUR 155); English product page shows USD 169 for the device alone (bundles USD 199 with Seed Phrase Steel, USD 219 with X Card).
Secure element
Yes: chip not named; CC EAL5+ (maker claim)
Firmware code
Not verified; reproducible build: not verified. No open-source firmware claim on maker pages read. Maker's 2019 post points to GitHub tools for firmware-update verification and QR data format; these are not the firmware. Coin Bureau (2026-04) describes the approach as 'mostly closed'.
Companion app
Not verified. No claim found on maker pages read.
—
Connections
USB: no data (charging only). Bluetooth: no. NFC: no. QR: yes. microSD: n/v.
Screen
4 inch colour IPS; touch: True
Assets
10,000+ tokens across 45+ blockchains (maker)
Multisig and PSBT
Not verified. Not mentioned on maker pages read; Coin Bureau says it is not ideal for multisig users.
Passphrase
Yes. Maker lists optional passphrase.
Shamir backup (SLIP-39)
Not verified. Maker uses BIP39 phrases; SLIP39 not mentioned.
—
Recovery phrase standard
BIP39: 24-word creation, 12/15/18/21/24-word recovery
Optional recovery service
Not verified. No recovery service found; maker sells Seed Phrase Steel backup plate separately.
FIDO / passkeys
Not verified. Not mentioned.
—
Bug bounty
Yes
Warranty
1 year; eligible claims receive a free replacement, not a repair (maker product page).
—

"n/v" or "not verified" means we could not confirm it from a source we could read. Maker claims are marked as such. Confirm on the maker's site before you buy. Education only, not investment advice.

Summary

Five facts

  • Official store lists Titan 2.0 at EUR 149 (Italian page) and USD 169 (English page) on 2026-10-11 [source 1].
  • Maker states a CC EAL5+ secure chip, 4-inch touchscreen and QR-only air-gapped signing with no WiFi, Bluetooth or USB data [source 2].
  • Maker pages read make no open-source firmware claim and list no third-party audit [source 2].
  • A 2025-10 XRP loss was attributed by Ellipal to a seed phrase imported into its app; no device compromise was confirmed [source 3].
  • ELLIPAL runs a bounty programme page; reward amounts and active status are not stated [source 4].
Independent checks

Audits

  • No independent audit found in our search.
Device record

Publicly disclosed weaknesses

  • 2019-12 Ledger Donjon published a physical-access study of the earlier ELLIPAL EC01 (UART, WiFi component, charge-only USB port, ECB-encrypted update); it extracted no seeds. ELLIPAL responded with firmware v2.0 and the redesigned Titan (sealed metal case, no WiFi/Bluetooth, contact charging). Not a study of Titan 2.0. Older than 5 years. Funds lost: no. Mitigated source

Disclosed weaknesses are listed whatever their severity. "Funds lost" is what the sources say. "Fixed" means the source states a fix exists, which only helps if you update.

Company record

Incidents at the maker or its service providers

  • 2025-10 A user reported losing about 1.2 million XRP (over USD 3 million at the time) on 2025-10-12. ELLIPAL said its investigation found the cold-wallet seed phrase had been imported into the ELLIPAL app, turning it into a hot wallet. Source reports no confirmed device compromise and does not say how the seed was obtained. Customer funds lost: yes. Outcome: No recovery or arrests reported as of 2025-10-19; Ellipal said it was in contact with the user. source
  • 2025-10-31 Per Coin Bureau, ELLIPAL's hot wallet services ended on 2025-10-31 (a service discontinuation, not a reported security event). Not verified at the maker's own site. Customer funds lost: not verified. Outcome: Not described in the source. source

These affect the company or its customers and apply to every device of the brand. They are not weaknesses of this device.

Questions

Questions about Ellipal Titan 2.0

Is Ellipal Titan 2.0 safe?

We do not give a yes or no, because safety depends on what you need to protect and on facts that change. We found 1 publicly disclosed weakness and 2 company incidents in our search. Read the sources above before you buy.

Does Ellipal Titan 2.0 need an internet connection?

Signing happens on the device. How the device talks to your phone or computer depends on its connections: QR. The companion app or software that builds the transaction is online.

Who found the weaknesses listed for Ellipal Titan 2.0?

The page names who disclosed each one when the source does. Several were found by a competing maker's research team or by independent security firms. We cite the affected company's own statement where we found one, and label press-only reports.

Sources

Where this comes from

Not verified: Not verified: company legal name and country (about page gives neither); SE chip model and certificate; open-source status of firmware and app (competitor claims by OneKey were not used); any independent audit of Titan 2.0 (none found); microSD (maker pages contradict); multisig; SLIP39; passkeys; reward amounts and whether the bounty is active; whether Titan 2.0 replaced the original Titan; the Coin Bureau note on hot-wallet shutdown was not confirmed at Ellipal's site. Only 25 of 30 searches used; no Ellipal-specific incident beyond 2025-10 was found, absence is not proof.

See how we check. To report an error, use corrections and right of reply.