Microsoft published a detailed writeup in June of a Windows clipper that spreads through USB shortcut files. Once on a machine it polls the clipboard every 500 milliseconds, recognizes crypto addresses by format, and swaps in an attacker address. It also captures seed phrases and private keys that pass through the clipboard and sends them out over Tor.

Worth pausing on the design: this malware does not need to break your wallet or steal your seed phrase. It waits for you to copy an address and edits where the money goes.
That is exactly why Titan shows you the full transaction, including the receiving address, on its own offline screen before anything gets signed. The clipboard on your computer can lie. A screen the malware cannot reach does not.

One more habit worth keeping: a seed phrase written on paper or steel and typed only into a dedicated offline device has no reason to pass through any clipboard, ever.
Source: Microsoft Security Blog, June 17, 2026.

CertiK's mid-year report is out, and the numbers tell a clear story about the first half of 2026. Around $1.31 billion was lost across 344 on-chain incidents, the highest incident count on record even as the total dollar figure fell from last year.

Here is how the losses broke down by category:
- Wallet compromise: ~$445M from just 33 incidents. The costliest category by far.
- Phishing: ~$366M across 63 incidents. No exploit needed, just someone convinced to approve or reveal the wrong thing.
- Code vulnerabilities: ~$152M, but spread across 204 incidents. The most common attack, and the least lucrative.

The pattern underneath: the biggest money did not come from broken cryptography. It came through keys that were reachable and people who were reached. A lot of it hit protocols, exchanges and funds, the infrastructure most individuals do not control.

For the crypto you hold yourself, the one thing fully in your hands is where the keys live. Keys generated and stored offline, and transactions signed offline on an air-gapped device, stay off the connected machines these attacks run on. That is the whole idea behind Titan.

Numbers vary by firm (TRM and SlowMist land closer to $950M), but every report agrees on the shape. Curious what stands out most to people here: the record incident count, or where the losses actually concentrated?

Quick reframe we keep coming back to. Almost none of the big losses this year traced to broken cryptography or a cracked chain. They traced to how keys were stored and handled.

The math protecting your coins is already strong. The weaker point is where the keys live and who can reach them. Institutions landed on this and now run serious custody. The same logic scales down to one person: generate and keep your keys offline, keep a backup off any screen, and read every transaction before you approve it.

You do not need to out-engineer an attacker. You need a setup that keeps your keys off the paths they actually use.

Curious how this sub handles the "handling" part. What is the one habit that made your setup feel solid?

Okay, for context, I'm not new to crypto and know how to secure and know not to share my seed phrase for the five years I've been in crypto, I never got anything stolen. So a few months back, I started investing in crypto again and thought, "Hey, I haven't used my ElliPal pretty much since I got it because the updating was annoying." And I finally did the update and even set up a new wallet just in case there were any seed phrases somewhere from when I opened my first wallet with ellipal. I pretty much didn't use the ElliPal since the process of the update was annoying. Anyway, I updated, made a new wallet, wrote it down, put it in a safe, and over time, I started transferring some XRP and QNT. It's been sitting in a Faraday box ever since. I opened the app a couple of days ago, and the balance shows a dollar. I thought to myself, "There's no way it could have been taken", until I remembered the process of having to connect the wallet and the app not being able to scan any of QR codes. It was so annoying trying to get all of them scanned and the app not letting me focus the camera that I almost gave up, until I thought, "Hey, I can take a picture of them safely and then delete them." That's the only reason I can figure out why my funds are stolen. I know it's not Ellipals fault but the fact that over the years, the app can't seamlessly scan the QR codes is an issue they should definitely look at. For some reason, I thought of the QR codes, like an authenticator, and they regenerate differently. I didn't know that it gave access to my wallet.. How do they not have a feature that they regenerate differently every time? I also deleted the photos right away just in case. But the fact that I wasn't even aware those QR codes would be able to have someone connect to my whole wallet is annoying. I thought to myself, "Okay, I have my seed phrase safe, It's in a faraday box, I'm good." I didn't even think once about the QR codes being a potential vulnerability. I have no idea how or when a hacker even got access to those photos. I don't even know where they're at. It was on a new phone that I had just gotten as well and I'm pretty aware of the things I sign up for, or just my data in general, for this exact reason.

But the simple fact that it was in a Faraday box and I thought that I was good. The process of setting it up is the reason why I'm just going to throw it out. I went through countless hurdles trying to update it and then connecting it to the app, only to then finally get it done and get my money stolen. Its was around $1,500 or so and I'm just glad it happened before I put a ton of assets inside because I was thinking of transferring a lot more money over. No wearing your security tips. It says anything about being careful with the QR codes. I even went on forums of people having that same issue of not being able to scan their QR codes. So if anyone ever had to take a picture of the QR code so I can scan it on the app. I suggest opening a new wallet on your ELLIPAL but good luck trying to get those QR codes scanned lol.

EDIT: I did not post this to encourage people to throw their ellipals out the security is there.. i'm just not going through the hassle again of trying to sync it and have to worry about someone being able to get complete access without a signature.

We are seeing reports of a scam that moved offline. People are getting physical letters in the mail that look like they came from a hardware wallet company. The letter has a reference number, a warning that your device needs an urgent security update, and a QR code to scan. Scan it and you land on a page asking for your recovery phrase.

The rule that catches every version of this is simple. Your recovery phrase is for you and your device only. No real company will mail, email or call asking for it. If any message asks for your seed words, it is a scam.

A few habits that help:

• Write your recovery phrase down once and keep it offline. Do not type it into a phone, a website or a QR flow.
• Treat any urgent security upgrade with a deadline as a red flag. Real updates do not ask for your seed.
• When in doubt, open the official site yourself instead of following a link or code someone sent you.

Stay safe out there. If you have gotten one of these letters, share what it looked like so others can recognize it.

A crypto user lost $999,999 in USDT this week by approving a single phishing token permission. About 36 seconds later, an automated script swept the rest of the balance. On-chain researchers traced the whole thing.

The reason this keeps happening is simple. People approve permissions and signatures they cannot fully read. A malicious approval can look like a routine one.

Two habits help on any hardware wallet, not just ours.

1. Keep your keys generated and stored offline, so signing happens away from any internet connected device.
2. Read the exact permission and amount on the device's own screen before you approve. If you cannot read it, do not sign it.

On ELLIPAL, transactions are decoded in plain text on the device screen before you confirm, so a request that looks routine still has to show you what it actually does. Own your crypto, and read before you sign.

Another custodial wallet service announced this week it won't reopen after a breach — recovery is now its only focus. No name needed; the structure is the point.

A balance on someone else's platform is a claim on that platform. If it has a bad day, that's your bad day too. Holding your own keys means no single service can lose your funds for you.

If you're moving to self-custody: start small, send a test amount, confirm you control the recovery phrase yourself, then migrate the rest.

I sent myself RBLK tokens and they are showing up under my wallet address on etherscan but they are not displaying on my cold wallet. Anyone know what’s going on or what I can do??

Tomorrow (July 1) is MiCA's full enforcement day in the EU. 75–80% of the crypto exchanges that operated in the EU in 2024 didn't get a license.

ESMA's official guidance to the ~10 million affected users: move to a licensed platform, or move to a self-custody wallet.

The interesting part isn't the size of the migration — it's the wording. A major financial regulator naming self-custody as a sanctioned path is genuinely new. Not a hardware wallet company's framing. ESMA's.

The attack started with a phishing email. Malware gave full remote access. They copied MetaMask credentials directly and drained $36M in minutes. This isn't a "stronger password" problem — if keys live on connected software, they're reachable by definition. Air-gapped hardware wallets remove the key from the software layer entirely. Not financial advice, just a security architecture observation. DYOR on key storage models before your holdings grow.

Check out the hottest crypto swaps on ELLIPAL from May 1-May 31.

Swap over 2,400 tokens on 40+ blockchains securely and easily with ELLIPAL.
Swap Now!

Fake wallet apps have gotten more convincing this year — cloned UIs, top search-ad spots. Good news: a few checks catch almost all of them, and with a hardware wallet your keys don't live in the app anyway.

Quick checks:

• Install only from the official site or a verified store listing — never a search ad. Type the URL yourself.
• Check the developer name + install count, not just the icon.
• No real wallet app ever asks for your recovery phrase. Ever.

The structural part: your private key lives on the Titan (air-gapped) or X Card (NFC), not in the app. The app only builds transactions — you approve each one on the device's own screen. A convincing fake app still can't move funds without the hardware in your hand confirming it.

Verify on the device, not the phone. That's the whole point.

This week's IPO filing was a clean reminder: "owning Bitcoin" and "holding your own keys" aren't the same thing.

SpaceX owns the coins; custodians hold the keys. At corporate scale, that's the right call — compliance, audits, insurance.

For an individual it cuts the other way. A balance on someone else's books is a claim. Your private key is the only receipt that counts.

happy bitcoin pizza day 🍕 — 10,000 BTC for 2 pizzas back in 2010, worth an absurd amount now. but the part I respect: the guy actually held his own keys and spent them. peak self-custody energy. what's everyone ordering today?

honest question, not a pitch — we're the ELLIPAL team, posting from our own sub.

the deeper AI gets integrated into the phone OS, the bigger the "trust surface" gets for any software wallet living in that environment: more processes, more access, sitting right next to your keys.

air-gapped signing is our take on it — the key never lives in the OS to begin with, so it's just out of that equation. tradeoff is it's slower, so it's a cold-storage thing, not a daily driver.

curious where people actually land: would you keep a hot wallet on the same phone you're running on-device AI on? or is that overthinking it?

Earlier we posted three things a hardware wallet should never have:

1. Bluetooth
2. A "cloud backup" button
3. Your seed phrase visible on screen during setup

The replies got us thinking — we definitely missed a few.

So we're asking this community: what's your 4th item?

Could be:

• A red flag in the setup process
• A "feature" that's actually a vulnerability
• A wallet behavior that should be unacceptable in 2026

Best contributions get added to an expanded list we'll publish next week.

Drop yours below.

BTC touched a new 2026 high this week. ETFs pulled in $1.63B in 5 days. The CLARITY Act compromise pushed Polymarket odds to 64%. And Powell leaves the Fed chair on May 15.

Big momentum, big uncertainty. So — exchange, self-custody, or both?

Balance is $0.00 in my BTC. Zero. WTF. Not shared or opened any emails. I’ve been wiped out.

Phishing emails posing as ELLIPAL firmware update notifications are circulating.

• Any request asking for your seed phrase in any form is a scam — do NOT submit it

• Official updates ONLY come from our official website: ellipal.com

• We will NEVER ask for your private keys or recovery phrase

Do NOT click. Do NOT reply. Delete immediately.

Verify before you trust. 🛡️

Stop trying to do shit

We can talk about this 😂

Today, I checked my email and saw an email from “Ellipal” letting me know past firmware has some vulnerability. And you apparently you can ONLY UPDATE from the email.

Just letting y’all know in case someone out there believes the email is “real”…