ELLIPAL's Titan is the big-screen consumer take on air-gapped signing: no ports for data, a camera for QR codes, and a self-destruct on tamper. Coldstar shares the air gap and drops everything else — the device, the price, and the closed firmware.
Titan for personal holdings you sign by hand; Coldstar for the treasury and agent keys that need policy.
| Coldstar | ELLIPAL Titan 2.0 | |
|---|---|---|
| Upfront cost | ~$10 — any USB drive. The software is free and MIT-licensed. | $149 (sale price from $169 at review). |
| Where the key lives | AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | On-device, CC EAL5+ secure chip. Auto-wipe on physical tampering. |
| How a transaction reaches the key | Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | QR only. No Wi-Fi, Bluetooth, or USB data. Fully air-gapped. |
| Source code | Open source (MIT) — every line that touches the key is readable on GitHub. | No open-source claims on the product page; firmware closed. |
| What you trust | Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | ELLIPAL's closed firmware and the secure chip. |
| Recovery | Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | Seed phrase; up to five wallets plus a hidden secondary wallet. |
| Automation & policy | CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. Human QR scan and confirmation per transaction. |
| Solana wallets | Coldstar CLI and Seeker app. | ELLIPAL app; dApps via WalletConnect and MetaMask bridging. |
| Maturity | Beta — independent audit planned before the production release. | Shipping consumer product, second-generation Titan. |
ELLIPAL and Coldstar agree on the air gap and disagree on everything around it. If you want a self-contained device and don't need to inspect the firmware, the Titan does the job.
The Titan puts the key in a secure chip inside a sealed device and moves transactions by QR. That removes the network path, which is the main thing. What remains is trust in firmware you cannot read and a chip that must resist physical attack if the device is stolen.
Coldstar removes the device. The offline computer decrypts an AES-256-GCM keyfile into memory-locked RAM for microseconds, signs, and wipes. The drive is storage, not a signer; stealing it yields ciphertext.
ELLIPAL is a shipping product; Coldstar is beta, pre-audit.
Not that ELLIPAL claims on its product pages at review time. Coldstar's code is MIT-licensed.
Against remote attackers, both remove the network path. Against a thief with the device, ELLIPAL relies on its chip and tamper wipe; Coldstar relies on the passphrase protecting an encrypted file. Against a bug in the signer itself, only Coldstar lets you look.
No. Every transaction needs a human to scan and confirm. Coldstar's policy engine lets an agent transact inside limits while the root stays cold.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.