Greenfield Capital is reported to have filed a governance complaint with Switzerland’s Federal Supervisory Authority for Foundations against the Safe Ecosystem Foundation and to have published an open letter on the Safe community forum. The immediate confirmed backdrop is narrower: Safe Ecosystem Foundation identifies itself as a Zug-based Swiss foundation under ESA supervision, while no regulator case number, acceptance notice, or formal procedural step has been disclosed.

Safe Foundation governance is the real issue

The core point is that Greenfield’s reported complaint fits the legal structure of Safe, even though the complaint itself is not yet visible. Safe Ecosystem Foundation says it is a non-profit Swiss foundation based in Zug, registered as CHE-295.207.842 at Bahnhofstrasse 16, and supervised by the Federal Supervisory Authority for Foundations in Bern. The foundation also names Wadsack Zug AG as its statutory auditor and says governance decisions made through Snapshot can be executed onchain without active foundation support.

That matters because it turns the dispute into a foundation-governance question, not simply a community disagreement. What remains missing is the procedural status: no ESA acknowledgment, case reference, hearing step, or complaint text has been disclosed. So the current state is best understood as a reported challenge to how the foundation is governed, not as evidence that the Swiss supervisor has already acted.

The Bybit hack is documented, the token claims are not

The cleanest distinction in this story is between the verified security incident and the unverified claims about what happened afterward. Sygnia’s investigation says Safe{Wallet} web resources were modified on 2025/02/19 and that Bybit detected unauthorized activity involving its Ethereum cold wallets on 2025/02/21. NCC Group likewise describes a targeted compromise of the Safe{Wallet} interface that altered transaction presentation or execution flow for the intended victim.

That gives Greenfield’s reported narrative a real event anchor, but it does not establish the more explosive allegations tied to SAFE token redistribution. No primary complaint, board record, governance proposal, token-transfer document, or named-party statement was produced here to support claims that directors or co-founders were pressured to give up SAFE, that Gnosis threatened to sell a large holding, or that any redistribution was completed. Those points may yet surface in a letter, filing, or governance thread, but for now they should be treated as allegations attributed to the report, not as settled facts.

This distinction is critical because it limits what can be inferred. A documented interface compromise can explain why governance tensions intensified after Bybit, but it does not by itself prove misconduct in token allocation or board behavior.

No verified regulator action against Safe operations yet

The practical implication today is governance scrutiny at the foundation level, not a confirmed order affecting Safe’s operating status. The supplied account says Greenfield’s complaints are aimed mainly at the Safe Ecosystem Foundation board and governance, not at the Safe Labs operations team. That aligns with the public structure: Safe Ecosystem Foundation is the Swiss foundation entity, while Safe Labs is presented separately in corporate disclosures.

As a result, the immediate risk is reputational and organizational rather than operationally dispositive. A complaint to a Swiss foundation supervisor can matter if it raises questions about whether a foundation is being run in line with its purpose and governance rules, but no disclosed ESA step currently shows such a process has moved into an enforcement phase. There is also no verified sign of a product restriction, shutdown order, or user-facing intervention.

The next concrete milestone would be one of four things: the underlying Greenfield letter, a filing acknowledgment from ESA, a formal response from Safe-related entities, or a documented board or governance change. Until one of those appears, the dispute remains important mainly as a challenge to Safe’s governance legitimacy rather than as a confirmed regulatory action against the protocol’s operations.