Is Zengo safe? What its terms and incident record say
Is Zengo safe?
Zengo's terms disclaim custody but do not settle who holds key material. No party is disclosed as able to block an address. No primary-source incident is recorded, which is not proof of none. Its terms name no gambling rule. Liability is excluded for all loss.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with Zengo and earns nothing if you install it. Every statement below is read from a document Zengo publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.
Zengo review: the documents
This is a review of the documents Zengo publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is Zengo Ltd.; on jurisdiction the record says: Israel. The custody position comes from the Zengo User Agreement, last updated June 2026, read 2026-10-07. The record quotes 6 clauses across 5 topics, and 1 sub-service clause where the app hands a swap, purchase or staking to another party. Zengo's terms disclaim custody but do not settle who holds key material. A cloud or hosted backup is offered, and by the record it changes who holds key material. 1 clause lets the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is excluded for all loss. Its terms name no gambling rule. 7 points could not be verified and are listed below.
Has Zengo been hacked?
No primary-source incident was found for Zengo in this collection: no company disclosure, no public vulnerability register entry and no regulator action. That is not proof that none happened. It is the absence of a search result, and a forum post or a press report is not recorded here until a primary source confirms it.
Zengo support and scams
The official domain in the record is zengo.com. The help pages this register read include Zengo help centre, Which assets does Zengo support. Type the domain yourself rather than following a link to it.
Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What Zengo stores, by the record: A recovery file, which Zengo states is not a private key, plus email authentication as a mandatory factor and a 3D FaceLock biometric scan as a recommended factor. Zengo separately holds the Server Share on its own servers.
Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like zengo.com, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for Zengo nor against it.
- The identity of the Trustee holding the Master Decryption Key, and whether the GitHub repository named in the agreement exists and is maintained. Not checked.
- Whether Zengo can refuse to co-sign a transaction with its Server Share, for example for a sanctioned address. The agreement retrieved contains no clause either reserving or denying that power, but the architecture makes it technically possible. Recorded as an open question, not a finding.
- Sanctions restrictions. No OFAC or sanctioned-country clause was found in the User Agreement.
- Named swap, on-ramp and staking providers. The agreement names none; the privacy policy names service providers such as Hubspot, Fathom.io, Google and Firefly but no crypto counterparties.
- The prediction-market provider. The agreement describes prediction-market access without naming the operator.
- Where the 3D FaceLock biometric data is stored and by whom. The privacy policy retrieved does not say.
- Documented incidents. No primary-source incident was located. Absence here is absence of a search result, not evidence of no incident.