Wallet Logo

SCTECHONE Touch xWallet

🔍 Last analysed 19th May 2022 . Leaks Keys Not functioning anymore
28th May 2018
10th April 2022

Jump to verdict 

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

Description

The SCTECHONE Touch xWallet has a horizontal smart card form factor with biometric capabilities and an e-ink display. The fingerprint scanner becomes a control interface after fingerprint initialization. It can pair with a mobile app.

The device’s homepage is no longer online. We suspect that the product has been discontinued.

From another website:

In the Touch xWallet, transactions are made safely with digital signatures between the card and mobile app via Bluetooth (BLE) when the correct fingerprint is in place. Its user can easily check info on the integrated display on the card, using the unique feature FPC MoveTouch® to scroll on the fingerprint sensor to select what is shown and what actions to make.

User Manual

This is a copy of the user manual.

Power sensor

  • On finger sensor bezel, the power sensor allows to turn the device On/Off with finger touch (for more than 1 second).

Finger sensor

  • With registered fingerprint, verifies finger authentication and unlockes the TouchWallet
  • With registered fingerprint, behaves as a navigational pad.

Display

  • Using E-ink, displays menu and battery change

Change Port

  • With built-in Micro-USB charge, charges using a smartphone charger

Private keys can be created offline - ✔️

Private keys are not shared - âť“

The user manual does not describe how the private keys are secured. We do know that the device can be paired with a mobile app using Bluetooth. We could not find the app anymore.

Device displays receive address for confirmation - ✔️

Interface - ✔️

Code and Reproducibility - ❌

Analysis

Since the device is no longer available in the market, we find it moot and academic to spend further time on it. Its website is offline and we could no longer find the device in Amazon.com. It pairs with a mobile app so there is a possibility for leaking private key information. Finally, we could also not find links to its source code.

(dg)

Verdict Explained

This product requires sharing private key material!

As part of our Methodology, we ask:

Leaks Keys!

Does the device hide your keys from other devices?

If the answer is "no", we mark it as "Leaks Keys".

Some people claim their paper wallet is a hardware wallet. Others use RFID chips with the private keys on them. A very crucial drawback of those systems is that in order to send a transaction, the private key has to be brought onto a different system that doesn’t necessarily share all the desired aspects of a hardware wallet.

Paper wallets need to be printed, exposing the keys to the PC and the printer even before sending funds to it.

Simple RFID based devices can’t sign transactions - they share the keys with whoever asked to use them for whatever they please.

There are even products that are perfectly capable of working in an air-gapped fashion but they still expose the keys to connected devices.

This verdict is reserved for key leakage under normal operation and does not apply to devices where a hack is known to be possible with special hardware.

But we also ask:

Defunct!

Is the product still supported by the still existing provider?

If the answer is "no", we mark it as "Not functioning anymore".

Discontinued products or worse, products of providers that are not active anymore, are problematic, especially if they were not formerly reproducible and well audited to be self-custodial following open standards. If the provider hasn’t answered inquiries for a year but their server is still running or similar circumstances might get this verdict, too.