Is Backpack safe? What its terms and incident record say
Is Backpack safe?
Backpack's terms place the keys with you and disclaim access to them. No party is disclosed as able to block an address. No primary-source incident is recorded, which is not proof of none. Its terms name no gambling rule. Liability is excluded for all loss.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with Backpack and earns nothing if you install it. Every statement below is read from a document Backpack publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.
Backpack review: the documents
This is a review of the documents Backpack publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is 200ms Labs Ltd.; on jurisdiction the record says: British Virgin Islands as governing law and arbitration statute. The custody position comes from the Backpack Terms of Service (PDF), last updated 20 June 2023, read 2026-10-07. The record quotes 5 clauses across 5 topics, and 2 sub-service clauses where the app hands a swap, purchase or staking to another party. Backpack's terms place the keys with you and disclaim access to them. No cloud or hosted backup is offered; recovery depends on the copy you keep. 1 clause lets the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is excluded for all loss. Its terms name no gambling rule. 7 points could not be verified and are listed below.
Has Backpack been hacked?
No primary-source incident was found for Backpack in this collection: no company disclosure, no public vulnerability register entry and no regulator action. That is not proof that none happened. It is the absence of a search result, and a forum post or a press report is not recorded here until a primary source confirms it.
Backpack support and scams
The official domain in the record is backpack.app. Type the domain yourself rather than following a link to it.
Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What Backpack stores, by the record: Nothing by 200ms Labs, by the terms. The user holds the twelve-word seed phrase and private key.
Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like backpack.app, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.
Backpack fees and limits
2 clauses in the record set a fee or a limit on what you can do through the app. They are quoted as written. Network fees paid to the chain are not part of the record.
Currently, we charge a flat 0.85% transaction fees on swaps.backpack.app
When you swap or bridge through Backpack Wallet, Backpack charges zero fees. No markups, hidden costs.learn.backpack.exchange
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for Backpack nor against it.
- Whether a newer wallet terms document exists. The terms at backpack.app/terms are dated 20 June 2023 and name 200ms Labs Ltd.; no newer wallet-specific terms were located.
- Which swap fee applies today. The terms say 0.85%; the March 2026 blog says zero. Recorded as a conflict, not resolved.
- The relationship between 200ms Labs Ltd. and the Backpack exchange entity. Not stated in any wallet document read.
- The full liability cap sentence. Only a fragment was captured verbatim; the cap is the greater of amounts paid and 100 US dollars.
- The default RPC provider, named swap aggregators and bridge providers. None named in the terms or privacy notice, which dates from 24 November 2022.
- Whether 200ms Labs can screen or block addresses. No clause either way was found.
- Documented incidents affecting Backpack Wallet. No primary-source incident was located. Absence here is absence of a search result, not evidence of no incident.