Trade Non-Custodially. Trade Carefully.

Axiom Is Non-Custodial

Axiom's documentation describes a non-custodial setup in which the platform does not hold your funds or keys. Key management is handled by Turnkey, and any detail about how that infrastructure is built comes from Turnkey's own published description of its service rather than from anything we can inspect. What you can check is your own account. Every one gets a 12-word seed phrase, retrievable any time from Settings, that you can export into Phantom, Rabby, or Solflare. Axiom's docs recommend doing exactly that so you keep access to your funds "under any circumstances," and the August 2025 outage that left users unable to sell through the app is the argument for taking that advice seriously. Read is Axiom Trade safe for the full picture. None of that custody model protects you on the wrong domain, so it is worth knowing what the real Axiom sign-up flow asks for and what a clone asks for instead.

MEV Protection

Axiom exposes three MEV modes on every buy: Off, Reduced (routes through Jito), and Secure (whitelisted validators only, slower). An October 2025 study by 0xGhostLogs found that Axiom users made up roughly 70% of Solana sandwich-attack victims over the prior year, across about 222,000 victims and 529,000 SOL extracted. The study measured who got sandwiched, not why, and this site has no way to separate Axiom's share of Solana volume from any pattern in how its users configure the setting. What follows from the finding is narrow and useful anyway: Secure is the mode that makes a sandwich hardest to build, and switching to it is the highest-leverage setting change available on the platform.

The February 2026 Incident

In February 2026, the investigator ZachXBT published evidence that an Axiom employee had used an internal support dashboard to look up users' wallets. Axiom confirmed the conduct, said it had removed access to the tools involved, and said it would investigate further. Axiom's statement and the reporting around it describe an insider misusing access rather than an outside compromise, and no reporting we have seen describes user funds or private keys being taken. What else the company found internally has not been published, so treat the public account as the limit of what is known. Read the full timeline in what actually happened.