Is SafePal safe? What its terms and incident record say
Is SafePal safe?
SafePal's terms place the keys with you and disclaim access to them. No party is disclosed as able to block an address. 1 primary-source incident is recorded. Its terms name no gambling rule. Liability is excluded for all loss. This answer reads documents; no code audit or test transaction was run.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with SafePal and earns nothing if you install it. Every statement below is read from a document SafePal publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.
SafePal review: the documents
This is a review of the documents SafePal publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is SkyGenesis Holdings Limited; on jurisdiction the record says: Not stated. The custody position comes from the SafePal Terms of Service, last updated 5 September 2024, read 2026-10-07. The record quotes 5 clauses across 5 topics, and 4 sub-service clauses where the app hands a swap, purchase or staking to another party. SafePal's terms place the keys with you and disclaim access to them. No cloud or hosted backup is offered; recovery depends on the copy you keep. 1 clause lets the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is excluded for all loss. Its terms name no gambling rule. 6 points could not be verified and are listed below.
Has SafePal been hacked?
One incident is recorded, each from a primary source: a disclosure by the company, a public vulnerability register or a regulator. The descriptions are the record’s, unedited, with the date and the source.
SafePal disclosed that an authorisation flaw in the order-tracking function of a plug-in exposed customer order information to unauthorised access between 2 March 2025 and 11 April 2026. About 39,798 customers were affected; names, email addresses, shipping addresses, phone numbers and purchase details were exposed. SafePal states seed phrases, private keys and wallet credentials were not involved.
This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials.
An incident on this list is a disclosed event, not a verdict on the product today. The absence of other incidents is not proof that none happened.
SafePal support and scams
The official domain in the record is safepal.com. Type the domain yourself rather than following a link to it.
Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What SafePal stores, by the record: Nothing by SafePal, by the terms. The user keeps the mnemonic words.
Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like safepal.com, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back. The record shows an incident that exposed customer contact details (dated above), which is the raw material for a message that knows your name.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for SafePal nor against it.
- SkyGenesis Holdings Limited's place of incorporation, registered address and company number. The terms and privacy policy give none, and no company register was checked.
- Governing law and dispute forum. None was found in the terms.
- Named swap, on-ramp and staking providers other than Fiat24.
- Whether SafePal itself can block an address or transaction. No clause was found either way.
- TON and Base support. Not confirmed on a current SafePal page.
- Cloud backup in the software app, if any. Not checked.
Sources
- SafePal Terms of Service, last updated 5 September 2024
- SafePal Privacy Policy, last updated 16 August 2026
- SafePal homepage
- SafePal Extension page, supported networks
- SafePal blog, TON support announcement, 17 November 2022
- SafePal blog, Unauthorized Access To A Subset Of Customer Order Information, 16 August 2026