Every recorded Ellipal security incident, newest first, with severity, fix status and sources.
Someone with physical access to an EC01 and lab tools could dump its encrypted keys and, if the password was weak, brute-force them, or backdoor the device. Ellipal states that no seeds were extracted and that firmware v2.0 and the Titan redesign address the findings.
More entries do not mean a less secure brand: widely sold devices draw more published research and more targeted attacks, and some vendors disclose more than others.
WalletInsights. Hardware wallet security incident tracker. Last checked November 3, 2026. https://walletinsights.io/en/security-incidents/ellipal/
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.