SafePal

Is SafePal safe?

The hardware does its main job well. A SafePal S1 creates and keeps your keys behind an EAL6+ certified chip and has no USB, Bluetooth, NFC or Wi-Fi, so it signs transactions only by exchanging QR codes with your phone. No theft has been traced to a SafePal device. We score SafePal 72/100, a B.

The catch is how little of it you can check, and what the company does with your data. The firmware is mostly closed, the published parts cannot be rebuilt, we found no public audit, and in August 2026 SafePal disclosed a leak of the names and home addresses of 39,798 buyers. Compare Trezor, whose firmware is fully open, or Tangem, which publishes outside audits.

The 2026 SafePal data breach

On 16 August 2026 SafePal said that unauthorised parties had accessed customer order information. An authorisation flaw in a plug-in customers used to track orders let people view other customers' orders: names, emails, phone numbers, shipping addresses and purchase details for about 39,798 people who ordered between 2 March 2025 and 11 April 2026. A separate configuration error had stopped old order records being deleted, which is why the window reaches back so far.

The timeline is not reassuring. BleepingComputer reported that SafePal first received a report in early May 2026 and treated it as isolated, and only found the flaw after a full review began in July. By then customers had already reported phishing emails and calls, including a fake warning that the X1 needed a firmware update. A seller on a cybercrime forum has offered the data. SafePal says seeds, keys and funds were not affected, has taken down more than 30 phishing sites, cut data retention to 90 days and hired an outside security firm. Company record scores 40, close to Ledger (38) and Trezor (40), which have both leaked customer addresses too.

How SafePal protects your keys

On the S1 and S1 Pro, the only link to the outside is the camera and screen. Your phone builds a transaction and shows it as a QR code, the device scans it, you check and sign on the device, and the signed result goes back as another QR code. Malware on the phone cannot reach the keys. The X1 adds Bluetooth for convenience, which widens what an attacker can talk to. All three use a CC EAL6+ chip, standard recovery phrases, an optional passphrase and a self-destruct mechanism that wipes the device if it detects tampering.

Kraken Security Labs tested the S1 in 2020. Its researchers opened the case without triggering the tamper alarm and reflashed an older firmware the device did not detect, but they could not steal the seed. SafePal called both issues non-exploitable and patched the downgrade in firmware 1.0.24. Key security scores 85: keys stay on a dedicated device, but nobody outside SafePal can check how the closed firmware handles them.

Bank account, card and perps in the app

The SafePal app is no longer only a wallet. It offers a Swiss IBAN account and a virtual Mastercard debit card, run with Fiat24, which SafePal says "solely handles the compliance and licensing". Money in that account is held by Fiat24, not in your self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet, and is outside this score. SafePal has also added a mini-program for perpetual futures on Hyperliquid and a SoDEX integration for tokenised stocks and gold; funds you move there sit on those platforms, and leverage brings liquidation risk.

Can you verify SafePal's code?

Only partly. In 2020 Kraken reported that the S1 firmware contained GPL-licensed components but SafePal declined to release the source, saying it was "not open-sourced yet". Since then SafePal has published firmware code for the X1 (2023) and the S1 (2025) on GitHub under GPL-3.0 and calls the X1 "fully open-sourced". WalletScrutiny still rates both devices "no source": the repositories have no build instructions, so no one can confirm the device runs that code.

We found no published third-party audit of the devices or the app, and no public bug bounty. Transparency scores 50.

What SafePal does about scams

The device shows the receiving address and amount on its own screen, which is your defence against a phone that has been tampered with. Readable approvals are the weak spot: contract calls on a small screen are hard to judge, and we found no transaction simulation or approval warnings documented for the SafePal app. Scam protection scores 65.

How to stay safe with SafePal

1. Buy from safepal.com or an authorised reseller, and ship to a pickup point if you can.
2. Install firmware only from inside the SafePal app or safepal.com, never from an email link, however urgent it sounds.
3. Ignore calls from "SafePal support"; SafePal says its staff never phone customers.
4. Write the recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on paper or metal and add a passphrase for larger holdings.
5. Check the address on the device screen before signing, and revoke old token approvals.

How we scored it

Key security (85) and the security record (82) are SafePal's strengths: an air-gapped device with a secure chip and no theft on record. Company record (40) is the weakest factor after the 2026 address leak, and transparency (50) is held back by closed firmware with no published audit. SafePal scores below Ledger and Tangem (both 78) because Tangem publishes outside audits of its cards and Ledger open-sources its apps and runs a bug bounty.