This product requires sharing private key material!
As part of our Methodology, we ask:
Does the device hide your keys from other devices?If the answer is "no", we mark it as "Leaks Keys".
Some people claim their paper wallet is a hardware wallet. Others use RFID chips with the private keys on them. A very crucial drawback of those systems is that in order to send a transaction, the private key has to be brought onto a different system that doesn’t necessarily share all the desired aspects of a hardware wallet.
Paper wallets need to be printed, exposing the keys to the PC and the printer even before sending funds to it.
Simple RFID based devices can’t sign transactions - they share the keys with whoever asked to use them for whatever they please.
There are even products that are perfectly capable of working in an air-gapped fashion but they still expose the keys to connected devices.
This verdict is reserved for key leakage under normal operation and does not apply to devices where a hack is known to be possible with special hardware.The product cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The product might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.
But we also ask:
Is the product still supported by the still existing provider?If the answer is "no", we mark it as "Not functioning anymore".
Discontinued products or worse, products of providers that are not active anymore, are problematic, especially if they were not formerly reproducible and well audited to be self-custodial following open standards. If the provider hasn’t answered inquiries for a year but their server is still running or similar circumstances might get this verdict, too.
Do your own research!
Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.
The Analysis ¶
The SCTECHONE Touch xWallet has a horizontal smart card form factor with biometric capabilities and an e-ink display. The fingerprint scanner becomes a control interface after fingerprint initialization. It can pair with a mobile app.
The device’s homepage is no longer online. We suspect that the product has been discontinued.
From another website:
In the Touch xWallet, transactions are made safely with digital signatures between the card and mobile app via Bluetooth (BLE) when the correct fingerprint is in place. Its user can easily check info on the integrated display on the card, using the unique feature FPC MoveTouch® to scroll on the fingerprint sensor to select what is shown and what actions to make.
This is a copy of the user manual.
- On finger sensor bezel, the power sensor allows to turn the device On/Off with finger touch (for more than 1 second).
- With registered fingerprint, verifies finger authentication and unlockes the TouchWallet
- With registered fingerprint, behaves as a navigational pad.
- Using E-ink, displays menu and battery change
- With built-in Micro-USB charge, charges using a smartphone charger
Private keys can be created offline - ✔️
Private keys are not shared - ❓
The user manual does not describe how the private keys are secured. We do know that the device can be paired with a mobile app using Bluetooth. We could not find the app anymore.
Device displays receive address for confirmation - ✔️
Interface - ✔️
Code and Reproducibility - ❌
Since the device is no longer available in the market, we find it moot and academic to spend further time on it. Its website is offline and we could no longer find the device in Amazon.com. It pairs with a mobile app so there is a possibility for leaking private key information. Finally, we could also not find links to its source code.
Share onTwitter Facebook LinkedIn
Or embed a widget in your website
<iframe src="https://walletscrutiny.com/widget/#appId=hardware/sctechone.touchxwallet&theme=auto&style=short" name="_ts" style="min-width:180px;border:0;border-radius:10px;max-width:280px;min-height:30px;"> </iframe>
<iframe src="https://walletscrutiny.com/widget/#appId=hardware/sctechone.touchxwallet&theme=auto&style=long" style="max-width:100%;width:342px;border:0;border-radius:10px;min-height:290px;"> </iframe>