// company_profile

About SafePal

SafePal is a cryptocurrency wallet company that builds hardware and software tools for people who want to hold digital assets themselves rather than leave them on an exchange. The company was founded in 2018, released its first hardware wallet, the SafePal S1, in 2019, and has since grown into a product family that spans air-gapped hardware devices, a mobile self-custody app, and a browser extension. This page explains who SafePal is, how the company is structured, what it builds, the security philosophy behind those choices, and how it makes money.

The short version: SafePal exists because self-custody is unforgiving. A private key is either under your control or it is not, and there is no support desk that can reverse a signed transaction. SafePal designs around that fact, keeping signing keys inside sealed hardware, never exposing them to a network connection, and pairing that hardware with software that stays usable enough for someone who is not a security engineer.

SafePal is publicly known as one of the wallet ventures backed by Binance Labs, the venture arm of the Binance exchange. That relationship gave the company early distribution and credibility in the retail crypto market, but SafePal wallets are non-custodial: the company does not hold customer funds, cannot freeze an address, and cannot recover a lost recovery phrase. Understanding that boundary is the most important thing to take away from this page.

0x1A 0xFF

// timeline

Where SafePal came from

// mandate

What SafePal is trying to do

These three commitments pull against each other in practice, and most of the engineering work at SafePal happens in the tension between them. Cheaper hardware means fewer components. Air-gapped signing means more steps for the user than tapping a connected device. True non-custody means no account recovery. SafePal's position is that the tradeoffs are worth stating plainly rather than smoothing over, because a holder who misunderstands the model is the holder most likely to lose funds.

// security_model

The security model behind SafePal products

Understanding SafePal as a company means understanding one architectural decision that shapes everything else: the private key never leaves the hardware, and the hardware never joins a network. Everything from the industrial design to the support policy follows from that.

Air-gapped signing, step by step

When you send a transaction from a SafePal hardware wallet, the phone app assembles the unsigned transaction and renders it as a QR code. You point the device camera at the phone screen. The device decodes the transaction, shows you the destination address, amount, and network fee on its own display, and waits. If you approve, the device signs internally and renders a second QR code containing only the signature. The phone scans that back and broadcasts it. At no point does a private key cross the gap, and at no point is the device reachable from the internet.

The verification screen is the part that matters most and is most often skipped. Address-swapping malware works by replacing a copied destination address after you paste it. The whole point of a SafePal device screen is that it displays what will actually be signed, sourced from the device itself rather than from the compromised machine. If the address on the SafePal screen does not match the address you intended, you decline, and nothing is lost.

Key generation and secure storage

Keys on SafePal hardware are generated on the device using a true random number source, not derived from anything the phone provides. They are stored inside a secure element, a tamper-resistant chip designed to make key extraction difficult even with physical access to the board. SafePal devices also implement self-destruct behavior: if the hardware detects tampering attempts, it wipes the stored secret, which is why your paper recovery phrase is the real backup rather than the device itself.

SafePal follows the standard BIP39 recovery phrase format, along with the BIP32 and BIP44 derivation standards that most modern wallets share. That interoperability is intentional. It means a SafePal recovery phrase is not locked to SafePal hardware, and a holder can restore the same accounts in another standards-compliant wallet if they ever need to. A company that wants to be trusted with keys should not make its customers dependent on its continued existence, and SafePal treats portability as part of the security promise.

What the model does not protect against

SafePal is explicit that air-gapping defends against remote key theft, not against every category of loss. A hardware wallet does not stop you from approving a malicious smart contract, signing a token allowance that drains a balance later, entering your recovery phrase into a phishing site that imitates SafePal, or sending funds to an address controlled by someone running a social engineering scam. Those attacks target the human decision, and the device dutifully signs whatever the human approves.

This is why SafePal invests in on-screen transaction detail, allowance management in the app, and repeated warnings about recovery phrase handling. The company's own framing is that the hardware closes one large attack surface and that user education has to close the rest.

// product_lines

What SafePal builds

SafePal ships three connected things: hardware wallets, a mobile app, and a browser extension. They are designed as one system, but each works on its own terms, and a new user can start anywhere in the stack.

How the pieces divide responsibility

The clean way to think about the SafePal stack is that the software knows your addresses and the hardware knows your keys. The app can build transactions, read balances, fetch prices, and display an NFT, all of which require only public data. It cannot move anything without a signature from the device. When SafePal software runs as a standalone software wallet, keys live in encrypted storage on the phone instead, which is convenient for small balances but not the same security tier as an offline signer.

Many SafePal users run both: a software wallet for day-to-day activity and small amounts, and a hardware-backed wallet for long-term holdings that rarely move. The company designs for that split rather than pretending one wallet fits every purpose.

// positioning

How SafePal compares to other custody choices

Rather than compare SafePal against named competitor devices, it is more useful to compare the categories a holder actually chooses between. The table below sets the SafePal hardware and software options against exchange custody and against a plain paper backup, using the criteria that matter when something goes wrong.

The pattern the table exposes is that convenience and recoverability sit on one side and independence sits on the other. An exchange can reset your password; it can also freeze your account or fail. SafePal cannot reset anything, and that is precisely why it also cannot be compelled to hand over your funds. Most holders eventually land on a mix, and SafePal is built to be the offline anchor in that mix rather than a replacement for every tool.

// verification

Credentials, audits, and how to check them

Security claims are only worth as much as the evidence behind them, so it is fair to ask what SafePal has actually put on the record. Two categories matter: independent evaluation of the hardware and software, and verifiable authenticity of the device you receive.

Independent review

SafePal has commissioned third-party security assessments of its hardware and firmware, and the company publishes audit information in its own documentation alongside the current firmware release notes. Because audit scope and dates change with each hardware generation and firmware version, the honest guidance is to read the report that matches the specific model and firmware you own rather than treating any single audit as a permanent stamp on the whole product line. Ask which version was tested, what was in scope, and whether findings were remediated.

The secure element class matters here too. SafePal devices use certified secure element chips, the same category of hardware used in payment cards and passports, chosen because they are designed to resist physical extraction attempts. Certification applies to the chip, not automatically to the entire device, which is why the firmware audits sit alongside it rather than being replaced by it.

Authenticity of the device you receive

Supply chain attacks are the practical risk with any hardware wallet, and the attack is simple: sell a preconfigured device with a recovery phrase the attacker already knows. SafePal ships with tamper-evident packaging and a self-check routine so a new owner can confirm the device has not been opened or pre-initialized. Two rules protect you regardless of brand. First, buy from SafePal directly or from an authorized reseller, never from a marketplace listing offering a suspiciously cheap or already-set-up device. Second, generate your own recovery phrase on the device during setup and refuse any device that arrives with a phrase printed, sealed in a card, or already stored.

If a SafePal package arrives with a broken seal, a device that powers on into an already-configured wallet, or any included paper listing words, the correct response is to stop, not use it, and contact SafePal support through the official app or website channels.

// operations

How SafePal operates and earns revenue

A wallet company's incentives tell you a lot about how it will behave, so it is worth being direct about where SafePal's money comes from. There are three main streams, and none of them involve holding customer assets.

The first is hardware sales. SafePal sells physical devices at a one-time price, through its own store and authorized distribution. This is straightforward product revenue, and it is the reason the company can offer its software wallet without charging a subscription.

The second is in-app service fees. When a user swaps tokens, buys crypto with fiat through an integrated provider, or uses other convenience features inside the SafePal App, there are fees attached, some charged by SafePal and some by the third-party liquidity or payment partner handling the transaction. These are optional services; a holder who only receives, stores, and sends assets pays network fees to the blockchain and nothing to SafePal.

The third is the SFP token ecosystem, which SafePal uses for fee discounts, promotional campaigns, and community incentives. The token gives the company a way to reward long-term users and align its community, but it is deliberately kept outside the security path. Nothing about custody, signing, or recovery in a SafePal wallet depends on holding SFP.

What SafePal explicitly does not do is take custody. It runs no order book for customer deposits, holds no client balances, and offers no yield product where the company takes possession of assets. That is a structural choice about risk: the largest crypto losses of the past decade have come from custodians failing, and a company that never holds funds cannot lose them. It also means SafePal has no ability to help in situations where a custodian normally would, which is the tradeoff a self-custody user accepts.

Data and privacy posture

Because SafePal never receives a private key or recovery phrase, the sensitive material simply is not present on its servers to leak. Using the app does involve network requests for balances, prices, and blockchain data, and third-party partners handling fiat purchases apply their own identity verification requirements under the rules that govern them. SafePal's own account-free model means creating a wallet does not require an email address or identity document, and the company documents which optional services do.

For privacy-focused users, the practical implication is that SafePal reduces custody risk and identity exposure at the wallet layer, while any fiat on-ramp used inside the app remains subject to the regulated partner's requirements.

// design_profile

Attack surface by wallet type

The chart below is a qualitative comparison, not measured data. It shows how the number of remote entry points into a signing key changes across storage approaches, which is the single variable SafePal is most focused on reducing. Longer bars mean more ways in for a remote attacker.

The remaining sliver at the bottom of that chart is the honest part. Air-gapping does not reach zero, because a user can still approve a harmful transaction and a device can still be physically stolen. SafePal designs the on-screen review flow and the PIN and wipe protections to address exactly that residual band.

// team_and_culture

The team and how SafePal works internally

SafePal is a distributed company with hardware engineering, firmware, mobile development, security research, and multilingual support functions. The combination is unusual in crypto: most wallet companies build only software, and building physical devices adds manufacturing, quality control, packaging integrity, and logistics to the work.

That hardware discipline shapes the culture. Firmware cannot be hot-fixed casually the way a web app can, so changes to the signing path go through review cycles that assume a mistake could be permanent for a user holding real assets. Release notes are versioned, older device generations are supported rather than abandoned, and the company documents which firmware version corresponds to which behavior.

Support is the other place where the company's structure shows. Because SafePal cannot recover a wallet, its support function is oriented toward prevention and process guidance rather than remediation: helping a user verify a firmware update, walk through a restore with a phrase they already hold, confirm whether a token contract is the one they think it is, or recognize a scam before they act on it. Support staff are trained to never request a recovery phrase, and the company states publicly that no legitimate SafePal channel will ask for one.

SafePal maintains an active presence across community channels in multiple languages, and a substantial part of its education work happens there: explaining allowance revocation, warning about impersonation accounts, and clarifying which announcements are genuine. Impersonation is common enough across the industry that SafePal treats channel verification as an ongoing operational task rather than a one-time notice.

// fit_assessment

Who SafePal is built for

Being clear about fit is more useful than claiming universal suitability. SafePal is aimed at a specific set of holders, and there are situations where a different approach serves someone better.

The recurring theme is responsibility. SafePal gives you a stronger set of tools than an exchange account, and in exchange it hands you the full weight of key management. That trade suits many people and genuinely does not suit others, and it is better to know which group you are in before you move funds.

// onboarding

How to get started with SafePal

If you have decided SafePal fits your situation, the sequence below is the order the company recommends. Each step exists to catch a specific mistake, so it is worth doing them in order rather than jumping to the end.

1. step_01

   Install the SafePal App and learn the interface with a small amount

   Download the SafePal App from the official app store listing and create a software wallet. Write the recovery phrase on paper as it is displayed. Send a small test amount, then send it back out. This teaches you the flow, the fee behavior, and the address checks with almost nothing at risk.

2. step_02

   Order hardware from an official channel and verify the seal

   Buy the SafePal device from the company's own store or an authorized reseller. On arrival, inspect the tamper-evident packaging before opening it. Run the device self-check. If anything looks opened, resealed, or pre-configured, do not proceed and contact SafePal support.

3. step_03

   Generate a fresh recovery phrase on the device itself

   Set a PIN and let the SafePal hardware generate a new recovery phrase. Copy it to paper or a metal backup plate, verify it when prompted, and store it somewhere fire-safe and away from the device. Never photograph it, type it into any app, or store it in cloud notes or a password manager sync.

4. step_04

   Pair the device with the app and run one test transaction

   Link the hardware to the SafePal App by scanning the pairing QR code. Send a small amount to the hardware-backed address, then send a small amount out of it, reviewing the destination on the device screen. Confirming that the address on the hardware display matches what you intended is the habit that protects you long term.

5. step_05

   Move the main balance and set a maintenance routine

   Once the test round trip works, transfer your long-term holdings. Then set a habit: check for SafePal firmware and app updates periodically, review and revoke stale token allowances, and confirm your recovery phrase backup is still where you left it and still readable.

// common_questions

Frequently asked questions about the company