SafePal

SafePal is a wallet company founded in 2018 by Veronica Wong and incubated by Binance Labs, offering a full self-custody suite: the S1 hardware wallet plus a mobile app and browser extension. Its signature product is the S1, a small offline device that generates and stores your private keys on a bank-card-grade EAL5+ secure element and signs every transaction inside itself, so the keys never touch an internet-connected phone or computer.

What makes the S1 unusual is that it is fully air-gapped: no USB data connection, no Bluetooth, no Wi-Fi and no NFC. The USB-C port only charges the device and updates firmware. To send funds you build the transaction in the SafePal app, which shows a QR code; the S1's camera scans it, you confirm on the device's own screen, and the S1 shows a signed QR code back to the app. Nothing sensitive ever leaves the device over a wire or a radio.

The S1's security rests on two things: an EAL5+ secure element that holds the keys, and air-gapped QR signing that keeps them off any networked device — together defending against remote malware and wireless attacks. As with any hardware wallet, the keys have not been remotely drained from the device; the weak points are human. Buy only from SafePal or an authorised reseller, and never type your recovery phrase into a phone, website or 'support' chat, because the device is the only place it belongs. SafePal also runs the SFP token used across its ecosystem, which is separate from the security of the wallet itself.

Where SafePal has been hit is off the device. In 2026 an authorization flaw in an order-tracking plug-in on its store let outsiders view other customers' order records, exposing names, emails, shipping addresses and phone numbers for roughly 39,800 buyers. Seed phrases, private keys and funds were not exposed and no device was compromised, but the leaked contact data fuels targeted phishing — which is exactly why any message asking for your recovery phrase should be treated as an attack. The incident is detailed below.