and the distribution of digital products.
State of Safe Q1 2025
- Total volume processed (TVP) reached an all-time high of $189.6 billion in Q1’25, up 65.1% QoQ, with Ethereum processing $82.9 billion and Base following at $72.7 billion.
- Safe smart account transactions hit a new record of 116.7 million in Q1’25, a 34% increase QoQ, with World Chain accounting for 91.2% of this activity.
- DEX trading volume for Safe smart accounts surged to $26.2 billion in Q1’25, up 442.5% QoQ. Base and Arbitrum led the surge, contributing over 78% of DEX volume together.
- World Chain was responsible for 60.1% of the 7.1 million new Safes created in Q1’25 and 94.3% of daily active users, while the total number of Safe smart accounts surpassed 41.6 million.
- In February 2025, a targeted hack on Safe’s web interface enabled the Lazarus Group to steal approximately $1.5 billion in assets from Bybit’s cold wallet; the Safe protocol and smart contracts were not compromised. Following the incident, Safe implemented stricter access controls, multi-factor authentication, cryptographic signing of web assets, and more frequent security audits and monitoring to strengthen its web interface infrastructure and prevent similar exploits going forward.
Safe (previously Gnosis Safe) aims to create the standard for ownership with smart accounts.
As of Q1'25 close, over $52 billion of assets were secured in 40+ million deployed smart accounts, making Safe one of the go-to solutions for smart contract wallets.
Safe is largely used as a multi-sig wallet. It enables individuals to securely self-custody their funds and organizations to manage their treasury operations effectively. As per Messari's wallet landscape analysis, Safe is a wallet infrastructure aggregator, in addition to offering smart contract wallets, namely:
- Safe{Wallet}: Main product in the form of a smart wallet solution (i.e., Safe’s user-facing smart contract wallet),
- Safe{Core}: Infrastructure protocol that powers both Safe’s wallet solutions and other projects (e.g., Worldcoin),
- Safe{Foundry}: Open source initiative on account and chain abstraction.
- Safenet: An unreleased payment processing network that allows for the quick and seamless transfer of assets stored in Safe smart accounts between blockchains.
The Safe community voted to make the SAFE token transferable in Q2’24. In Q3’24, Safe launched community-aligned fees for native swaps as the first integration within Safe{Wallet} to facilitate revenue generation for SafeDAO.
Key Metrics
Performance AnalysisNetwork AnalysisThe usage of Safe can be gauged in terms of account and transaction activity across Safe’s multiple deployments. As of Q1’25, Safe has been deployed on 20+ networks, including Arbitrum, Avalanche, Base, Blast, BNB Chain, Celo, Ethereum, Fantom, Gnosis Chain, Linea, Mante, OP Mainnet, Polygon, Polygon zkEVM, Scroll, Worldchain, Mantle, Ronin, Sonic, Ink, and ZKsync.
New Safes
In Q1’25, approximately 7.1 million new Safe smart accounts were created, down 30.5% QoQ. World Chain continued to drive the majority of growth, accounting for 4.3 million (60.1%) of all new deployments. OP Mainnet accounted for 2.2 million (30.3%) new Safe smart accounts. Polygon followed with 513,000 (7.2%) and Base with 108,100 (1.5%). These networks, along with World Chain, represented 99.1% of Safe smart account creation during the quarter.
Prior to the launch of World Chain, World migrated from Polygon to Optimism’s ecosystem through OP Mainnet in Q2’23. The continued growth in deployments on both World Chain and OP Mainnet is largely attributable to new World ID issuance, with World App remaining one of the first applications to use Safe smart accounts at scale.
After strong growth in new Safes in Q1’25, the total number of Safe smart accounts created passed the 40 million milestone this quarter. Roughly 24.4 million Safe smart accounts have been created on World Chain, representing 58.1% of the 41.6 million Safe smart accounts in total.
Active Safes
In Q1’25, the 30-day moving average of Safe’s daily active users (DAUs), defined as smart accounts that execute at least one outbound transaction per day, declined 12% QoQ to 514,000. World Chain remained the dominant network, accounting for 484,800 DAUs or 94.3% of the total.
Polygon followed with 21,900 DAUs (4.3%), while other networks contributed marginally. OP Mainnet averaged 2,100 DAUs (0.4%), and Gnosis followed with 2,600 (0.5%). All other networks, including Ethereum, Base, Arbitrum, and BNB, accounted for less than 1% each.
Transactions & Adoption
Safe smart account transaction activity continued to rise in early 2024, with accelerated growth in Q4’24 following the launch of World Chain by World (formerly Worldcoin). World App, built on a Safe smart account, allows users to interact onchain. The application initially supported Polygon, later expanded to OP Mainnet, and now facilitates activity on World Chain.
World App differs from standard wallets like MetaMask by enabling users to hold a World ID, which is World’s unique identifier for humans. Holders of a World ID can transact on World Chain without paying fees, which contributed to the increase in transaction volume.
In Q1’25, Safe smart account transactions rose 34% QoQ from 87.1 million to 116.7 million. Of the 116.7 million transactions, 106.4 million occurred on World Chain, representing 91.2% of total volume. Polygon and Gnosis followed with 3.7 million (3.1%) and 3.3 million (2.8%) transactions, respectively. Optimism processed 1.8 million transactions (1.5%), while all other networks accounted for less than 1% each.
Safe’s adoption rate, defined as the percentage of Safe transactions relative to total transactions across all supported networks, rose from 4.5% in Q4’24 to 5.8% in Q1’25.
Financial AnalysisTotal Value Secured
One of the primary metrics used to assess Safe is total value secured (TVS), which measures the dollar value of all assets held in Safe smart accounts. In Q1’25, TVS decreased by 46.6% QoQ, closing the quarter at $52.3 billion.
Ethereum secured $45.3 billion (86.6%) of all assets held in Safe smart accounts. BNB Chain followed with $2.3 billion (4.3%), OP Mainnet with $1.8 billion (3.4%), Base with $787.9 million (1.5%), and Arbitrum with $530.5 million (1.0%). These five networks collectively accounted for 96.8% of total assets secured in Q1’25.
Total Volume Processed
Total volume processed (TVP) measures the dollar value of fungible assets sent to and from Safe smart accounts. In Q1’25, TVP climbed 65.1% QoQ, rising from $114.8 billion to $189.6 billion. This marked a new all-time high (ATH) for quarterly TVP, a consecutive quarterly ATH, and a new monthly ATH of $77.5 billion in January 2025.
Ethereum processed $82.9 billion (43.7%) of total TVP during the quarter. Base followed with $72.7 billion (38.3%), Arbitrum with $18.0 billion (9.5%), Polygon with $5.8 billion (3.1%), Berachain with $3.5 billion (1.8%), and BNB Chain with $2.9 billion (1.5%). Together, these six networks accounted for 97.9% of all TVP in Q1’25.
DEX Volume
In Q1’25, Safe smart accounts traded $26.2 billion through decentralized exchanges, up 442.5% QoQ. This marked a new all-time high in quarterly DEX volume, surpassing the previous record set in Q4’24. Notably, Safe smart accounts set back-to-back monthly ATHs in DEX volume in Q1’25, extending its consecutive monthly ATH streak to four. With $8.4 billion traded in January and $10.6 billion in February 2025, these record-setting months contributed to the all-time high in quarterly DEX volume.
Base DEX volume grew 4,165.7% QoQ from $296.2 million to $12.6 billion (48.1% of total volume). Arbitrum increased 2,154.4% QoQ from $348.6 million to $7.9 billion (29.9% of total volume). Ethereum rose 47.4% QoQ, from $3.7 billion to $5.5 billion (21.0% of total volume). Polygon declined 43.4% QoQ from $276.9 million to $156.8 million (0.6% of total volume). All other networks combined fell 55.5% QoQ from $172.6 million to $76.8 million (0.3% of total volume).
Fees
In Q1’25, Safe smart accounts generated $881,800 in fees from native swaps, up 50.1% QoQ. This was driven by $758.7 million in swap volume, up from $394.0 million in Q4’24 (+92.6%). Ethereum accounted for $704.2 million of swap volume. Base followed with $34.7 million, Arbitrum with $11.8 million, and Gnosis with $8.0 million. Ethereum also contributed the majority of fees, generating $782,700. Base followed with $69,400, Arbitrum with $21,400, and Gnosis with $8,300. Avalanche recorded no fee-generating activity during the quarter.
Community-aligned fees for native swaps were introduced in Q4’24 following SafeDAO’s approval of a license-based revenue model. This marked the protocol’s first monetization stream. Safe’s native swaps feature uses CoW Protocol to execute trades within Safe smart accounts. The fee structure is tiered and varies by trade size and pair type.
For non-stablecoin pairs:
- 0.35% for trades up to $100,000;
- 0.20% for trades between $100,000 and $1,000,000;
- 0.10% for trades above $1,000,000;
For stablecoin-only pairs:
- 0.10% for trades up to $100,000;
- 0.07% for trades between $100,000 and $1,000,000;
- 0.05% for trades above $1,000,000;
Additional revenue mechanisms, including native staking, are expected to launch in the future.
Market Cap
In Q1’25, SAFE’s circulating market cap decreased 38.0% QoQ from $522.6 million at Q4’24 close to $324.0 million at the end of Q1’25. That said, SAFE’s market cap amongst all tokens rose 25 spots from 164 to 139, outperforming similarly valued cryptoassets. The price of SAFE decreased 42.3% QoQ from $0.99 to $0.57.
Qualitative AnalysisBybit/Safe HackBetween Feb. 4 and Feb. 21, 2025, a sophisticated hacking group known as the Lazarus Group targeted Safe’s web interface as part of a coordinated attack on Bybit’s cold wallet. The Lazarus Group is a state-sponsored cybercrime organization linked to North Korea and is known for orchestrating high-profile attacks on financial institutions and cryptocurrency platforms worldwide.
The attack began when the Lazarus Group compromised a Safe developer’s workstation through social engineering tactics. This allowed them to obtain AWS session tokens associated with Safe’s infrastructure. Using these credentials, the attackers accessed the AWS S3 bucket that hosted JavaScript resources for the Safe web interface.
On Feb. 19, the Lazarus Group injected malicious JavaScript code into the Safe web interface. This code was engineered to activate only when Bybit’s specific Safe wallet address accessed the interface, ensuring that the attack was precisely targeted and did not affect other Safe users. The injected code manipulated the transaction data displayed to Bybit’s authorized signers, making the interface show legitimate transaction details while secretly altering the underlying transaction to redirect funds to addresses controlled by the attackers.
On Feb. 21, Bybit employees initiated a transaction from their cold wallet using the Safe web interface, believing it to be a routine transfer. Because the interface had been compromised, the transaction details they reviewed were falsified, concealing the true destination of the funds. The Lazarus Group first executed a small test transaction to confirm their control, and shortly thereafter, transferred the entire balance of 401,347 ETH and then 90,375 stETH, 15,000 cmETH, and 8,000 mETH out of Bybit’s cold wallet, in subsequent transactions. Minutes after the theft, the malicious code was removed from the Safe web interface, limiting immediate detection and complicating forensic analysis.
Throughout the incident, the core Safe protocol and its multisignature smart contract logic were not breached or compromised. The attackers did not exploit any cryptographic or protocol-level vulnerabilities within Safe itself. Instead, they used the compromised web interface to deceive the authorized signers during transaction approval, effectively bypassing the multisignature safeguards. Safe’s involvement in the breach was limited to the exploitation of its web interface infrastructure, and the attack was not a failure of Safe’s smart contracts.
Since the incident, Safe has implemented enhanced security measures for its web interface infrastructure, including stricter access controls, multi-factor authentication, and cryptographic signing of all web assets. Safe has also increased the frequency of security audits and real-time monitoring to detect unauthorized changes, including improving its incident response protocols to enable faster detection and mitigation of potential threats.
Closing SummaryIn Q1 2025, Safe recorded 7.1 million new smart accounts, bringing the total to 41.6 million. World Chain accounted for 4.3 million new accounts and 106.4 million of the 116.7 million total transactions, representing 91.2% of transaction volume. Total volume processed was $189.6 billion, a 65.1% increase QoQ. DEX trading volume reached $26.2 billion, up 442.5% QoQ. Fee revenue from native swaps totaled $881,800, a 50.1% increase QoQ. Total value secured decreased 46.6% to $52.3 billion. SAFE’s market capitalization declined 38% to $324 million, with its rank among cryptoassets improving by 25 positions to 139.
On Feb. 21, 2025, a security breach attributed to the Lazarus Group resulted in the theft of approximately $1.5 billion in Ethereum from Bybit’s multisignature cold wallet. The attack was executed by injecting malicious JavaScript code into Safe’s web interface, which altered transaction details during the signing process. The code was activated only for specific contract addresses, including Bybit’s, and manipulated the transaction to redirect funds to the attacker’s address while presenting legitimate details to authorized signers. The Safe protocol and smart contracts were not compromised; the exploit targeted Safe’s web interface infrastructure. In response, Safe has strengthened its web interface security through stricter access controls, multi-factor authentication, cryptographic signing of web assets, increased security audits, and enhanced real-time monitoring and incident response.
Looking ahead, Safe remains well-positioned to continue its growth and leadership in smart account infrastructure. With ongoing investments in security and user protection, Safe is well-positioned to continue to deliver a robust, secure solution.