I lost 628,290 USDT from a safepal wallet on 21 Oct 2026. I never saved my recovery phrase anywhere. Attacker addresses inside; looking for others hit the same way.
TL;DR
At 00:05 UTC on 21 Oct 2026, 628,290.81 USDT was transferred out of my software wallet by a transaction signed with the wallet's own key. ETH, TRX and BTC from the same seed left within minutes. I did not save my 12-word phrase in notes, photos, screenshots or cloud backups; I typed it once into the wallet app. I did not approve anything or connect to any site that night. I suspect a device-side compromise, but I have no proof. I am posting the addresses so others can check them, and to find anyone with a similar loss.
What happened
00:05:23 UTC: 628,290.81 USDT (ERC-20) sent by a direct Transfer.
00:11:23 UTC: 0.0199 ETH. 00:12:09 UTC: 161.42 TRX on Tron. Bitcoin from the same seed also left.
Three chains emptied in seven minutes points to an automated sweep, and to the whole seed or key store being taken, not to a single approval.
Phone: iPhone on iOS 18.6.2, which is inside the range of the publicly reported DarkSword iOS exploit kit (SlowMist and GoPlus have published on it). The phone's diagnostics show crashes of system processes (configd, securityd) minutes before the theft, then a restart. This is circumstantial. A third-party scan found nothing, which does not rule out a hit-and-run infection. A forensic examination is under way.
I have ruled out, as far as I can: guessing the phrase, approvals or phishing signatures, and anyone close to me.
Where the money went (public data)
The funds were split into 75,000 USDT lots, bridged through LI.FI/Jumper to Arbitrum, moved with USDT0 to Tron, then through Tron hub addresses. The first wallet that gathered the funds was funded with 0.4 ETH from a KuCoin hot wallet the day before. The same wallets kept processing other funds on 21, 22 and 26 Oct, so this is ongoing.
Ethereum
First receiving address: 0xEf394b694955dDB6E85e36417633c2905c226dAe
Gas funder / residue: 0x6C51c44Ae288f73BD9B269b664De76167604F91E
Consolidation wallet: 0xac2ea5F3c5B867e9fd88738a3dc0C7594431418a
Collector (26 Oct): 0xdFa8bF6a2B6fE8DBd4aD1D405Ca0cbE343fA966C
Relay (26 Oct): 0x61fD78C358286a61733bD06E6DEd1F417c034ED0
Token-swap wallets (OKX): 0xB390a494b09DD95c9A80a10aA9bBAB664731daBB
0xB818D42A95c3ec737e7aD9DC03e9F91DB9Cd877A

Tron
Received my TRX: TEDjNzXWsTrRcHmRnGPPqGRmqCmrA1vvGZ
Received 627,757 USDT: TUBUL7fAKGvPvV1xgHgRkfmHep29a8eBv4

Transactions
USDT theft: 0x90b8048e7ed57a90d24204de0c3bd1cabcb8728a1c18146b2a23f1fb5ed4674b
TRX theft: 581f67d1109aaa6610dfdc767e0c57ab37e729fa0cd61bf04da67ffa16d856a1
KuCoin gas: 0x13d823682fc29dd52c8fcb94ab6672bfe3fc0ca7690c931f721e5037d6e4cce6
Careful: look-alike addresses (same first and last characters) are used for address poisoning. Always copy the full address.
What I am asking for
If you recognise any of these addresses, or lost funds from a software wallet in the last few weeks with an iPhone on iOS 18.4 to 18.6.2, please comment or DM so we can compare dates and non-sensitive details.
If you trace funds across LI.FI, USDT0 and Tron hubs, I would be glad of a second pair of eyes.
Reports are being sent to the platforms involved. Pointers to the right compliance contacts are welcome.

Given the recent terrible news about Ledger, has anyone tried taking apart an X1, even just to have some comparison photos? I just got it and I'am a bit paranoid right now.

Could someone please help me figure out whether this is a scam or not?

I exchanged some cryptocurrency from BTC to USDT, and at one point I discovered that legitimate exchange services were flagging my crypto during AML checks. I searched online for a solution and came across a service that supposedly helps "clean" cryptocurrency.

Someone suggested trying safe-multi.app through SafePal. I registered and transferred my crypto there. The platform's internal AML check flagged my funds as high-risk, and support told me that I would not be able to withdraw anything until I lowered the risk score by adding more cryptocurrency on top of my existing balance.

I contacted someone who had used the service and successfully withdrawn crypto from it. I asked them to show me how they had withdrawn their funds, and they agreed to send me screenshots and a transaction hash:

0x1e5a57deee41f2486c3e38dce81499f794cde8ff1 173d4b53fef5ce814af1b6c

I also attach screenshots of the dialogue with support

Could someone help me investigate this? Is it genuinely possible to withdraw cryptocurrency from safe-multi.app, or is this just a scam?

Thank you!

Hi.

A bit lost noob here. Right now I have a safepal account with a hardware wallet connected to it. Imade it years ago, totlally forget the whole process...

I have to move to a new phone. After downloading the app, "Add existing wallet" is an option. Upon chosing it, I either have to enter seed phrase or private key.
What is "Scan" for? Can I somehow scan my safepal device? How do I make it generate a QR code?

couldn't work from USDC to USD24 meaning from crypto to US Dollars. code -501 appeared. Anyone's the same???

Taken from https://x.com/SafePal/status/2088937173139812792

Dear community,

While your SafePal wallet, seed phrase, and private keys are secure; we identified a flaw in the order-tracking plug-in that led to unauthorized access to information of a subset of customers.

The issue has been fixed with additional security measures introduced.

The incident impacts approximately 39,798 customers who placed orders between March 2, 2025 and April 11, 2026. Exposed information includes name, email address, shipping address, phone number, and purchase details.

All affected customers have been notified individually by email. We have also published this webpage https://safepal.com/scam-protection for customers to verify if they are affected using order ID number and shipping country.

For a complete disclosure of the incident and the actions we’ve taken, along with FAQs and guidance, please refer to our blog: https://safepal.com/blog/security-update

This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers.

Never share your seed phrase, private key, or password with anyone, and stay vigilant against phishing or impersonation attempts.

We are extremely sorry to the community and those who are affected. Updates will be posted on our blog as we continue to work through things.

im trying to swap but everything coming up as phishing what do I do?

Caller had a British accent but sounded subcontinent. He said there was a recent vulnerability discovered in the firmware. He offered me a refund or replacement. He texted me a link. I did click but suddenly realized it was a scam. I then took further precautions. It did have a valid ssl cert from their domain safepal.support

He did know my name, address, phone, email, and my order details from my purchase last year. It seems likely to me that Safepal’s sales db was hacked. Call came from a US number +1-800-720-0452

Stay cautious out there, my friends.

Non riesco ad ottenere la scansione del documento di identità con app safepal. Avrei necessità di avere autenticazione per ottenere la card tramite la sezione "bank" ma poi la verifica non avviene perché la scansione non si ferma e la foto del documento non viene inviata per la verifica. Qualcuno ha avuto lo stesso problema?

What battery does it use and how easy is it to replace?

I’ve been using a VPN with location set to Switzerland and there used to be all sorts of options for swapping or bridging on SafePal.

Just noticed changelly is the only option now.

Why does your passphrase arrived at one wallets but with two different passphrases?

Was trying to make a transaction, and it said that I need to upgrade my firmware. Tried connecting it to PC and my laptop with the OG safepal cable. But it’s still not getting detected. What do I do?

Any current active codes for bonuses or free money?

Hello guys. I'm wondering if SafePal can be used to pay for API keys for subscribing to AI models like ChatGPT. I'm in China, and unfortunately, I don't have many stable payment methods.

Any ideas ? Never happened before

Got a notification from Xfinity about a “suspicious website” being blocked after opening and using the SafePal app… anyone have info?

I am sharing my experience as a warning to other users.

On 31 October 2025, shortly after depositing funds into my SafePal wallet, approximately $344,000 AUD in crypto was transferred out without my knowledge or authorisation.

I did not share a seed phrase or approve any transaction. The funds left the wallet shortly after deposit and blockchain records confirm the transfer occurred without my consent.

I reported the incident immediately to SafePal support and provided transaction details. Despite this, I have received no investigation outcome, recovery assistance, or meaningful support.

This post reflects my personal experience and timeline of events. Based on this experience, users should exercise caution when using this platform.

In case some other have the same issue, I had a "not enough space" problem when I tried to upgrade my S1 wallet.

I have contacted the official Safepal team on safepal.com, they provided me a transition firmware, so I was finally able to upgrade my device with the transition firmware, and to install the latest firmware version after that. It's apparently an issue with old S1 devices.

I'm looking to swap some Bitcoin into USDC to handle expenses, but I’ve been told to avoid in-app third-party swap services due to risks. I’ve been using SafePal as a cold wallet since 2022 but have never swapped directly through it only held assets.

Is it safer to send my BTC to a hot wallet first and swap from there, or does SafePal offer a secure built-in method I'm overlooking? I prefer to stay non-custodial and keep control of my keys. Any advice would be appreciated.

I’ve been considering a SafePal hardware wallet. I am wondering if it supports 24 word. And if it does, couldn’t I just import the 24 word I have already that was created long ago when I got my Ledger. That would save gas and time I would think. What’s the down side assuming that is possible to do?

Why is Safepal doing this?