Is Xverse safe? What its terms and incident record say
Is Xverse safe?
Xverse's terms place the keys with you and disclaim access to them. No party is disclosed as able to block an address. No primary-source incident is recorded, which is not proof of none. Its terms name no gambling rule. Liability is capped at a stated cap, quoted on the entry.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with Xverse and earns nothing if you install it. Every statement below is read from a document Xverse publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.
Xverse review: the documents
This is a review of the documents Xverse publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is Secret Key Labs Limited; on jurisdiction the record says: Hong Kong governing law and exclusive Hong Kong venue. The custody position comes from the Xverse End User License Agreement, undated, read 2026-10-07. The record quotes 4 clauses across 4 topics, and 4 sub-service clauses where the app hands a swap, purchase or staking to another party. Xverse's terms place the keys with you and disclaim access to them. A cloud or hosted backup is offered. 1 clause lets the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is capped at a stated cap, quoted on the entry. Its terms name no gambling rule. 9 points could not be verified and are listed below.
Has Xverse been hacked?
No primary-source incident was found for Xverse in this collection: no company disclosure, no public vulnerability register entry and no regulator action. That is not proof that none happened. It is the absence of a search result, and a forum post or a press report is not recorded here until a primary source confirms it.
Xverse support and scams
The official domain in the record is xverse.app. The help pages this register read include Xverse help centre, Xverse Cloud Backup Security. Type the domain yourself rather than following a link to it.
Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What Xverse stores, by the record: The seed phrase, encrypted with a key derived by Argon2 from a strong password the user sets.
Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like xverse.app, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.
Xverse fees and limits
One clause in the record set a fee or a limit on what you can do through the app. They are quoted as written. Network fees paid to the chain are not part of the record.
You agree to pay such Access Fee from your stacking rewards; and understand and agree suchxverse.app
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for Xverse nor against it.
- Whether the issuers of the stablecoins held in Xverse Cash (USDC on Starknet, USDB on Spark, USDCx on Stacks) can freeze balances, and whether Xverse discloses this anywhere. Not disclosed in the documents read; the homepage says nobody can freeze funds.
- The terms governing Xverse Cash and the Due direct-deposit service, including any KYC. Not found in the agreement or privacy policy.
- The third-party Token Swap provider. Not named in the agreement.
- The Access Fee rate on stacking rewards. The agreement leaves it to the Company's discretion.
- Sanctions or geographic restrictions. None found in the agreement.
- The agreement's and privacy policy's last-updated dates. Neither page showed one.
- The full limitation of liability clause. Captured in two fragments because of a quote-length limit in retrieval.
- Secret Key Labs Limited's place of incorporation. Not stated.
- Documented incidents. No primary-source incident was located. Absence here is absence of a search result, not evidence of no incident.