Padre, now called Terminal and owned by Pump.fun, has no reported hack of its own as of October 2026. Its wallets are non-custodial on Turnkey, according to independent analysis. The risks are a wallet password that can't be recovered, thin official documentation, an owner with a 2024 insider exploit on its record, and live fake Padre sites.
Risk notice: Crypto trading is high risk and memecoins can go to zero in minutes. Trading bots and wallet connections use hot wallets. This page is not financial advice; only trade what you can afford to lose.
Facts on this page were checked October 23, 2026, from Padre's and Pump.fun's own pages and the sources linked below. This is a research-based review built from published docs, not a hands-on trial. For fees and features, see the full Padre review.
What we checked
| Check | What we found |
|---|---|
| Company/team | Acquired by Pump.fun on October 24, 2025 (Blockworks); Terminal's terms name Inspired Acquisitions, Ltd. as operator (Terminalpedia) |
| Custody | Non-custodial Turnkey wallets with a password the platform doesn't store (Terminalpedia; not in official docs) |
| Known incidents | None for Padre/Terminal. Owner Pump.fun: May 2024 insider exploit, about $2 million |
| Audits | No public third-party audit of Terminal found |
| Phishing risk | High: padreapp[.]com flagged and still live in October 2026 |
Who runs Padre now?
Pump.fun announced on October 24, 2025 that it had bought Padre, a terminal for Solana, BNB Chain, Base and Ethereum (Pump.fun on X). Padre was renamed Terminal and now lives at terminal.pump.fun. Terminalpedia, an independent guide updated in October 2026, says Terminal's terms of service name "Inspired Acquisitions, Ltd." as "the owner/operator of Terminal." In February 2026 Pump.fun also bought the Vyper terminal and merged its team into Terminal (The Block).
So the honest answer to "who runs Padre?" is Pump.fun, through a separate legal entity. That gives Terminal the backing of the biggest Solana launchpad, along with Pump.fun's track record, good and bad.
Custody: who controls your funds?
Padre's official docs say little about custody. The best detail comes from Terminalpedia's reading of the live app:
- Turnkey wallets. Keys are held on Turnkey, and the site's security policy allows Turnkey's export and import domains, which Terminalpedia cites as confirmation.
- A password only you know. Terminalpedia quotes Padre: "Padre never stores or has access to your password."
- No recovery flow. Lose that password and you may lose access to the wallets. Terminalpedia advises exporting private keys at sign-up and storing them offline.
- "2FA" isn't an authenticator app. Terminalpedia says the Padre-era "2FA" is password encryption over the Turnkey keys, while login is social sign-in through Firebase.
Because these points come from a third party, not Pump.fun, treat them as reported rather than confirmed. The practical rule doesn't change: export your keys, keep them offline and keep only a trading balance in Terminal.
Incidents: Padre, Terminal and Pump.fun
Padre and Terminal. We found no reported hack, exploit or loss of user funds as of October 23, 2026. In our method, its security sub-score is 9.0, the starting value for a product with no confirmed incident.
The PADRE token. When Pump.fun bought Padre, it said the token would have no further utility, and it fell about 80%. After a backlash, holders were offered PUMP tokens (Blockworks). This was a financial loss for holders, not a security breach, but it shows how fast terms can change with ownership.
Pump.fun's 2024 exploit. In May 2024, Pump.fun lost about $2 million (roughly 12,300 SOL) when an attacker used flash loans to buy out bonding curves; Pump.fun said connected wallets were safe and paused trading (The Block). The attacker was a former Pump.fun developer, Jarett Dunn, who was sentenced in London to six years in prison in December 2025 (Decrypt). This predates the Padre deal and didn't touch Padre, but it is the kind of insider risk any large operator carries. Pump.fun's own record is covered in is Pump.fun safe?.
Fake Padre and Terminal sites
Terminal's 35% cashback headline is now bait:
- padreapp[.]com poses as "Padre Terminal ... 35% Fee Cashback." PhishDestroy first detected it on September 4, 2026, rates it critical, and found it still live on October 23, 2026.
- migrate.padre[.]company was a wallet-connect drainer using the Angel Drainer kit, flagged in November 2025 and since taken offline (PhishDestroy). A "migrate" page is a classic lure after an acquisition.
- Look-alikes such as padregg[.]org are listed as not official by Terminalpedia.
Why this works on traders: the real Terminal also asks you to sign in and set up a wallet, so a fake sign-in or "connect wallet" screen doesn't look out of place. The difference is that a fake page will ask you to connect an outside wallet such as Phantom and approve a transaction, or to paste a seed phrase, before you've traded anything.
The official domains, per Terminalpedia, are terminal.pump.fun, trade.padre.gg, padre.gg and app.padre.gg. Pump.fun has never needed you to "migrate" a Padre wallet through a separate site.
Safety checklist for Padre (Terminal)
- Type terminal.pump.fun yourself and bookmark it. Never use a "Padre" link from an ad, DM or reply.
- Ignore migration, airdrop and PADRE-claim pages. None is needed to keep using Terminal.
- Set a strong, unique wallet password and store it safely. There is no recovery if you lose it.
- Export your private keys at sign-up and keep them offline.
- Secure the social login (Google, X or similar) with two-factor, since it's your way in.
- Keep a small balance and withdraw profits often.
- Turn on MEV protection and check the fee shown on your first trade (MEV protection explained).
- If funds vanish, follow Solana wallet drained: what to do.
Setup steps are in how to use Padre, and the back story is in Padre Terminal explained. Wider risks: are Solana trading bots safe?
Our verdict
Our editorial view: Padre (Terminal) is legit and has a clean security record of its own, with a custody model that looks sound on paper. What holds it back is that most security detail comes from third parties rather than Pump.fun, the password can't be recovered, and an active fake site is copying its cashback offer. It scores 7.1/10 in our ranking.
Weighing it against others? See Padre vs Trojan, Axiom vs Padre, Padre alternatives and the safest Solana trading bot ranking.
