← Safe{Wallet}reviewed 2026-09-07 · 27 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Safe{Wallet} against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #4[disputed][awaiting moderator]in section: Overview and Background
“the Safe Ecosystem Foundation was incorporated and SafeDAO was formed in 2023 after a fundraise from strategic investors”
reviewerFollowing a GnosisDAO community decision, the Safe Ecosystem Foundation was incorporated and SafeDAO was formed in 2023 after a fundraise from strategic investorsThe cited source itself, plus an independent Swiss registry record, place the Foundation's incorporation and fundraise in 2022 (specifically March 20, 2022 for incorporation). SafeDAO's governance constitution (SEP-4) was adopted in 2023, which may be the source of the confusion, but that is a different event from the Foundation's incorporation or SafeDAO's initial formation.Proposed correction (not yet applied)the Safe Ecosystem Foundation was incorporated and SafeDAO was formed in 2022 after a fundraise from strategic investors - #5[disputed][awaiting moderator]in the timeline
“2023”
reviewerSafe Ecosystem Foundation formally incorporated; SafeDAO formed following strategic fundraise from investors (dated 2023)Same underlying date error as the Overview section; the cited source does not actually support 2023.Proposed correction (not yet applied)2022 - #6[disputed][awaiting moderator]in the timeline
“Project rebranded from Gnosis Safe to Safe; SAFE governance token launched with 1 billion total supply.”
reviewerProject rebranded from Gnosis Safe to Safe; SAFE governance token launched with 1 billion total supply, dated 2022-04-20The token appears to have been minted April 20, 2022 (consistent with on-chain/exchange data), but the public rebrand to the 'Safe' name is separately and consistently dated to July 2022 across the page's own cited source and independent reporting. Conflating both events under the April date is a factual error.Proposed correction (not yet applied)SAFE governance token minted with 1 billion total supply; the public rebrand from Gnosis Safe to Safe followed in July 2022 alongside a $100 million funding round.citediq.wiki/wiki/safe - #8[disputed][awaiting moderator]in the timeline
“2024-04-25”
reviewerSAFE token reached its all-time high on 2024-04-25 (per CoinMarketCap)Minor date mismatch: the timeline entry cites CoinMarketCap specifically, but CMC's own recorded ATH date is April 23, 2024 (the April 25 figure matches Coinbase's ATH date instead).Proposed correction (not yet applied)2024-04-23
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #9[unverifiable][awaiting moderator]in section: SAFE Token and Governance
“As of approximately April 2026, SAFE traded at roughly $0.14 per token, with a market capitalization of approximately $104 million — representing a decline of approximately 94% from its all-time high.”
reviewerAs of approximately April 2026, SAFE traded at roughly $0.14 per token, with a market capitalization of approximately $104 million, a decline of approximately 94% from its all-time highDirectionally consistent with SAFE's well-documented decline (current price is even lower, consistent with continued depreciation since April 2026), but the specific point-in-time figures could not be independently confirmed from an archival source. - #20[unverifiable][awaiting moderator]in section: Safe's Remediation Response
“By March 3, 2025, co-founder Martin Koeppelmann confirmed that ten specific changes had been shipped to the UI, including: displaying full raw transaction data to signers, removing hardware wallet integrations that raised security concerns, and implementing stricter validation and enhanced monitoring.”
reviewerBy March 3, 2025, co-founder Martin Koeppelmann confirmed ten specific UI changes had been shippedDirect fetch/search of the specific crypto.news article to confirm the exact 'ten changes' figure and the March 3 date was not completed within the review's search budget; the general remediation narrative is plausible and consistent with Safe's public statements, but the specific number and date were not independently re-verified against a fetched primary source. - #26[unverifiable][awaiting moderator]in section: Scope of Compromise: What Was and Was Not Affected
“No other confirmed cases of funds being stolen via this specific attack vector have been publicly reported as of June 2026, consistent with the payload's narrow, Bybit-targeted design.”
reviewerNo other confirmed cases of funds being stolen via this specific attack vector have been publicly reported as of June 2026This is an assertion of absence; no comprehensive search was found confirming or contradicting it, and proving a negative of this kind is outside what a reasonable review search budget can establish with confidence.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #24[partially supported][awaiting moderator]in the timeline
“Rahul Rumalla joined the Safe ecosystem as VP of Product and Engineering; later became CEO of Safe Labs as the subsidiary took direct operational control of Safe{Wallet}.”
reviewerRahul Rumalla joined the Safe ecosystem in July 2024 and later became CEO of Safe LabsThe core claim (joined July 2024, later became Safe Labs CEO) is confirmed, but his original July 2024 title is documented as 'VP of Engineering,' not 'VP of Product and Engineering'; he reportedly held a 'Chief Product Officer' title at a different point before becoming CEO, which may be the source of the conflation.
confirmed
19 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“securing approximately $35 billion in assets across 61 million accounts as of Q1 2026”
reviewerSafe secures approximately $35 billion in assets across 61 million accounts as of Q1 2026Figures match Safe Foundation's own Q1 2026 report almost exactly ($35.25B / 61.11M accounts). - #2[confirmed][no action needed]in section: Overview and Background
“The platform processed a record 122.9 million transactions and 4.79 million ETH in transaction volume in Q1 2026 alone.”
reviewerSafe processed a record 122.9 million transactions and 4.79 million ETH in transaction volume in Q1 2026Matches Safe Foundation Q1 2026 report figures exactly. - #3[confirmed][no action needed]in section: Overview and Background
“Safe reported over $10 million in annualized recurring revenue for 2025, a fivefold increase from approximately $2 million in 2024.”
reviewerSafe reported over $10 million in annualized recurring revenue for 2025, a fivefold increase from approximately $2 million in 2024Independently corroborated by The Block. - #7[confirmed][no action needed]in section: SAFE Token and Governance
“The token reached an all-time high of approximately $2.69–$4.48 (sources vary) in April–May 2024.”
reviewerSAFE token reached its all-time high of approximately $2.69-$4.48 in April-May 2024The explicit 'sources vary' hedge is accurate; different exchange trackers report ATH figures spanning the stated $2.69-$4.48 range on dates between April 23 and May 3, 2024. - #10[confirmed][no action needed]in section: February 2025 Supply-Chain Compromise: The Bybit Heist
“On February 21, 2025, approximately $1.5 billion in ETH and stETH was stolen from cryptocurrency exchange Bybit in what became the largest cryptocurrency theft in recorded history.”
reviewerOn February 21, 2025, approximately $1.5 billion in ETH and stETH was stolen from Bybit, the largest cryptocurrency theft in recorded historyWidely and independently corroborated as the largest crypto theft in history. - #11[confirmed][no action needed]in section: February 2025 Supply-Chain Compromise: The Bybit Heist
“Forensic investigations by Sygnia and Verichains, commissioned in the aftermath of the hack, determined the attack originated from a supply-chain compromise of Safe{Wallet}'s developer infrastructure — not from any flaw in the Safe smart contracts themselves.”
reviewerForensic investigations by Sygnia and Verichains determined the attack originated from a supply-chain compromise of Safe{Wallet}'s developer infrastructure, not a flaw in the Safe smart contractsDirect WebFetch of sygnia.co returned HTTP 403 (likely bot-blocking, not link rot, since an archive_url is on file and content is corroborated via search and mirrored reporting). - #12[confirmed][no action needed]in section: February 2025 Supply-Chain Compromise: The Bybit Heist
“The developer was induced to download a file named 'MC-Based-Stock-Invest-Simulator-main,' a Docker-based project that exploited a remote code execution vulnerability in the PyYAML library to gain control of the host system.”
reviewerThe developer was induced to download a file named 'MC-Based-Stock-Invest-Simulator-main,' exploiting a PyYAML RCE vulnerability, on approximately February 4, 2025Corroborated by secondary write-ups (gbhackers.com, cyberpress.org) summarizing the same Sygnia findings. - #13[confirmed][no action needed]in section: February 2025 Supply-Chain Compromise: The Bybit Heist
“On February 19, they modified the file '_app-52c9031bfa03da47.js' hosted in Safe's AWS S3 bucket, which serves JavaScript assets for app.safe.global.”
reviewerOn February 19, attackers modified the file '_app-52c9031bfa03da47.js' hosted in Safe's AWS S3 bucket, activating only for Bybit's contract addressesThis specific filename and date are widely repeated across independent security research write-ups (Sygnia, Elastic, Check Point) of the same incident. - #14[confirmed][no action needed]in section: February 2025 Supply-Chain Compromise: The Bybit Heist
“The Safe Ecosystem Foundation's statement confirmed that 'the forensic review of external security researchers did NOT indicate any vulnerabilities in the Safe smart contracts or source code of the frontend and services.'”
reviewerThe Safe Ecosystem Foundation's statement confirmed 'the forensic review of external security researchers did NOT indicate any vulnerabilities in the Safe smart contracts or source code of the frontend and services'Exact quote verified word-for-word against the live source page. - #15[confirmed][no action needed]in section: Attack Attribution: DPRK TraderTraitor / Lazarus Group
“On February 26, 2025, the U.S. Federal Bureau of Investigation (FBI) issued a public service announcement formally attributing the Bybit theft to North Korea's TraderTraitor threat group.”
reviewerOn February 26, 2025, the FBI issued a PSA formally attributing the Bybit theft to North Korea's TraderTraitor threat groupDirectly verified against the live FBI/IC3 source. - #16[confirmed][no action needed]in section: Attack Attribution: DPRK TraderTraitor / Lazarus Group
“by March 20, 2025, approximately 86% of the stolen ETH had been converted to Bitcoin and dispersed across thousands of addresses using decentralized exchanges, cross-chain bridges, and multiple intermediary wallets.”
reviewerBy March 20, 2025, approximately 86% of the stolen ETH had been converted to Bitcoin and dispersed across thousands of addressesThe 86% figure is independently corroborated, though the timeline entry cites a lesser-known secondary aggregator (Cloudskope) rather than the primary blockchain-analytics source (Elliptic) that appears to be the original basis for this figure. - #17[confirmed][no action needed]in section: Attack Attribution: DPRK TraderTraitor / Lazarus Group
“The FBI requested that RPC node operators, exchanges, and blockchain analytics firms block transactions originating from 50+ identified addresses linked to the laundering operation.”
reviewerThe FBI requested that RPC node operators, exchanges, and blockchain analytics firms block transactions from 50+ identified addressesVerified directly against the live FBI/IC3 PSA text. - #18[confirmed][no action needed]in section: Responsibility Dispute: Safe vs. Bybit
“Bybit's forensic review concluded that 'the credentials of a Safe developer were compromised,' framing Safe's infrastructure as the proximate cause.”
reviewerBybit's forensic review concluded that 'the credentials of a Safe developer were compromised'Confirmed via search snippet of the cited CoinDesk article; direct WebFetch was rate-limited (HTTP 429) but corroborating quotes appear consistently across secondary coverage of the same CoinDesk report. - #19[confirmed][no action needed]in section: Responsibility Dispute: Safe vs. Bybit
“A parallel dispute between WazirX and Liminal Custody following a $230 million exploit in July 2024 has been cited as a precedent for similar unresolved custody-layer responsibility conflicts.”
reviewerA parallel dispute between WazirX and Liminal Custody following a $230 million exploit in July 2024 has been cited as a precedentIndependently confirmed. - #21[confirmed][no action needed]in section: Safenet: Structural Response to the Attack Vector
“On April 2, 2026, Safe Foundation announced the launch of Safenet Beta at EthCC in Cannes.”
reviewerOn April 2, 2026, Safe Foundation announced the launch of Safenet Beta at EthCC in CannesConfirmed via GlobeNewswire and Safe Foundation's own blog post. - #22[confirmed][no action needed]in section: Safenet: Structural Response to the Attack Vector
“The network launched with six genesis validators — Greenfield, Gnosis, Safe Labs, Rockaway, Blockchain Capital, and Core Contributors GmbH — each staking a minimum of 3.5 million SAFE tokens.”
reviewerThe network launched with six genesis validators — Greenfield, Gnosis, Safe Labs, Rockaway, Blockchain Capital, and Core Contributors GmbH — each staking a minimum of 3.5 million SAFE tokensVerified directly against the primary source. - #23[confirmed][no action needed]in section: Safenet: Structural Response to the Attack Vector
“Staking rewards are pending SafeDAO approval under SEP-55 as of the launch date.”
reviewerStaking rewards are pending SafeDAO approval under SEP-55 as of the launch dateVerified verbatim against the primary source. - #25[confirmed][no action needed]in section: Scope of Compromise: What Was and Was Not Affected
“Multiple independent forensic investigators confirmed that the Safe smart contracts deployed on-chain were not compromised at any point.”
reviewerThe Safe smart contracts deployed on-chain were not compromised at any point; the malicious code did not affect Safe's mobile applications or browser extensionsWell corroborated across all major security research reports (Sygnia, Elastic, Check Point) of this incident. - #27[confirmed][no action needed]in section: Attack Attribution: DPRK TraderTraitor / Lazarus Group
“The same group has been linked to prior major crypto thefts including the Phemex and Poloniex hacks.”
reviewerThe same group [TraderTraitor/Lazarus] has been linked to prior major crypto thefts including the Phemex and Poloniex hacksBoth prior incidents are well-documented Lazarus Group attributions independent of this page.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.