Hardware wallet design is a series of trade-offs between security, convenience and cost, and the honest way to review one is to name the trade-off it made rather than list its certifications. Card-format wallets like the ELLIPAL X Card have made a very specific choice, and whether it is right for you depends entirely on how you intend to use it.
The X Card is $66.95, down from $133.90, available as a single card or a three-card set. Here is the architecture, why it is genuinely well-designed, and the limitation that no amount of good engineering removes.
Published specification
| Specification | Value |
|---|---|
| Form factor | Bank-card sized NFC cold wallet |
| Secure element | CC EAL6+ certified secure chip |
| Key standard | BIP39 seed phrase |
| Power source | None - draws power by NFC from the phone on tap |
| Battery | None |
| Wireless radio | None of its own; NFC only, at a few centimetres |
| Firmware | No firmware to update |
| Signing | Transaction signed inside the chip; only the signed result leaves the card |
| Packages | 1 Card set, 3 Cards set |
| Finishes | Black, BTC, Raspberry Rose |
| Price | $66.95 (regular $133.90) |
Why the "no battery, no radio, no firmware" design is genuinely clever
Each of those three absences removes an entire category of attack surface, and it is worth spelling out why.
No battery means there is nothing to charge, nothing to degrade, and nothing that dies in a drawer after three years. That last point is not trivial. A meaningful number of hardware wallet problems are simply that the device would not power on when the owner finally needed it. A passive card powered by the reader has no such failure mode - it works in ten years exactly as it works today.
No wireless radio of its own is the security argument. Bluetooth and Wi-Fi are the interfaces attackers reach for, and a device that only communicates via NFC at a few centimetres cannot be approached remotely. You have to physically tap it. That is about as narrow a communication channel as a usable wallet can have.
No firmware to update cuts both ways, and I will come back to the downside. The upside is real: firmware update mechanisms are themselves an attack vector, and supply-chain and malicious-update attacks against hardware wallets are a documented concern. A device with nothing to flash cannot be compromised that way.
The CC EAL6+ secure chip is the same certification class used in payment cards and passports, and it is a meaningful standard rather than a marketing word - it describes an independently evaluated level of resistance to physical and side-channel attack. Combined with BIP39 compatibility, it also means you are not locked in: a standard seed phrase can be restored into other wallets that support the standard, which is exactly what you want from a device holding long-term keys.
What works
- It is genuinely pocketable. A wallet you actually carry gets used; a wallet in a safe becomes a thing you avoid touching.
- Nothing to maintain. No charging, no updates, no cables.
- Standards-based recovery via BIP39 rather than a proprietary scheme.
- Multi-card sets make geographic backup practical rather than theoretical.
- Independently meaningful chip certification at a price well below the screened hardware wallet tier.
Three honest drawbacks
1. There is no screen, and that is the central trade-off. This is the most important paragraph in this review. On a hardware wallet with a display, you verify the recipient address and amount on the device's own screen - a screen the malware on your phone cannot alter. On a screenless card, the only thing showing you what you are about to sign is the phone app. If your phone is compromised, it can display one destination and pass a different transaction to the card, and the card will faithfully sign it inside its lovely EAL6+ chip. The key never leaks, and your funds still leave. This is a known limitation of the entire card-wallet category, not a flaw specific to ELLIPAL - and note that ELLIPAL's own Titan line has screens precisely because of it. Understand it before choosing.
2. "No firmware to update" also means no updates. The security benefit is real, but so is the cost: if a vulnerability is found, there is no patch, and if a new signing scheme or chain standard emerges, the card cannot gain support for it. You are buying the device's capabilities as they exist today, permanently. For long-term storage of established assets that is arguably fine; if you expect to need new functionality, it is a constraint.
3. A card is easy to lose, bend or destroy. The form factor that makes it convenient makes it fragile in ways a chunky device is not. Cards go through washing machines and get sat on. ELLIPAL selling a three-card set and a separate card case is a reasonable response, but it tells you something: you should plan on redundancy, and that means the realistic cost is the multi-card set rather than the single. Also note the practical requirement - you need a phone with working NFC, which rules out some older and budget handsets.
One further point on the pricing: $66.95 against a $133.90 reference is a 50% reduction. As with any store where the discount is prominent, judge it on the price you will pay rather than the anchor.
Who should buy it - and who should not
Buy it if you want durable, maintenance-free offline key storage, you are comfortable with the screenless verification model, and you will use it primarily to hold rather than to transact frequently. Buy the multi-card set and store the cards in separate physical locations - that is where this form factor genuinely outperforms a single bulky device.
Skip it if you sign transactions often, particularly interacting with contracts where knowing exactly what you are approving matters - buy a wallet with its own screen instead. Skip it if your phone lacks NFC, if you want a device that can receive security updates, or if you are not confident you can keep a card-sized object safe for years.
Verdict
The X Card is a coherent, well-engineered product that makes its trade-off deliberately: it strips out the battery, the radio and the firmware to shrink the attack surface and the maintenance burden, and it accepts screenless signing as the price. The CC EAL6+ chip and BIP39 compatibility are the right foundations. Whether it suits you comes down to one question - can you accept verifying transactions on your phone rather than on the device? If yes, this is a lot of security architecture for $66.95. If no, spend more and get a screen.
Card sets and finishes are on the official ELLIPAL store, and our brand overview is on the Ellipal store page.
Disclosure: this article contains affiliate links. If you buy through them we may earn a commission at no extra cost to you. All specifications and prices were taken from the manufacturer's official product page and are subject to change. This article reviews a hardware security product only and is not financial or investment advice. Never share your seed phrase with anyone, including anyone claiming to be support staff.
