Recently, the DEXX platform suffered a security breach that raised serious concerns within the Web3 community. Despite claiming to offer “non-custodial” services, DEXX stored user private keys and transmitted them over the internet in plain text. This vulnerability not only undermines its decentralization claims but also exposes users to significant risk of asset theft.
Figure 1: DEXX platform's claim of being a non-custodial wallet contradicts its centralized practices.
This incident serves as a crucial reminder of the core principle in the Web3 space: “Not your keys, not your coin.” Only by holding your private keys can you truly own your crypto assets. When private keys are entrusted to third-party platforms, even those that claim to be “decentralized,” users may face unexpected security risks.
Understanding the Types of Wallets
In the Web3 world, the type of wallet you choose dictates your asset security and control. Here’s an overview of the main types of wallets:
Custodial Wallets
These wallets are managed by centralized entities, where users do not handle their own private keys. While convenient, the control over assets lies entirely with the service provider. History has shown numerous cases where exchanges were hacked or collapsed, leading to severe losses for users.
Non-Custodial Wallets
These wallets empower users to hold and manage their own private keys and assets. Only the user has access to and can control their funds. Hardware wallets like ELLIPAL Titan are prime examples of non-custodial solutions, featuring an Air-gapped (completely offline) design that ensures private keys never come into contact with any network, offering the highest level of security.
Hybrid Custodial Wallets
These wallets combine elements of custodial and non-custodial management, with private keys split between the user and a service provider. While this balances security and control, there are still risks of asset freezes or misuse.
The Deeper Warning from the DEXX Incident
Despite DEXX's claims of being non-custodial, the platform stores user private keys for its “one-click trade” feature, effectively putting users’ assets under platform control. This practice contradicts its decentralization claims and highlights the hidden risks of platforms with centralized characteristics.
Figure 2: The DEXX interface showing the private key export process, exposing its centralized nature.
Warning: Even platforms that pass audits from renowned firms like CertiK are not immune to security flaws. The DEXX incident illustrates that audit reports may not cover all potential risks. CertiK has stated that their audits focus solely on smart contracts and do not extend to centralized code.
The ELLIPAL Titan Solution
To ensure the security of your assets, we recommend using the ELLIPAL Titan hardware wallet. Its unique Air-gapped technology keeps the device completely isolated from networks, preventing private keys from being exposed to external devices or online threats. Whether it's recovery phrases or private keys, ELLIPAL Titan ensures they are stored securely offline, providing unmatched protection.
Conclusion: When choosing a wallet, don’t rely solely on a platform’s claims. Make sure you hold your own keys with a trusted non-custodial solution like ELLIPAL Titan, so your assets remain truly yours.