SafePal Breach Exposes the Weak Link Around Hardware Wallet Security
- SafePal says an authorization flaw exposed order data belonging to 39,798 customers.
- Names, email addresses, phone numbers, shipping addresses and purchase details were accessed.
- Seed phrases, private keys, wallet passwords and payment data were not compromised.
SafePal has disclosed a data breach affecting 39,798 customers, but the most consequential part of the incident sits outside the wallet software itself. An authorization flaw in an order-tracking plugin exposed names, emails, phone numbers, shipping addresses and purchase information belonging to customers who ordered between March 2, 2025 and April 11, 2026.
SafePal said it found no evidence that wallet access or customer funds were compromised, and seed phrases, private keys and passwords were not exposed. The breach instead highlights a different problem for hardware-wallet providers: a device can protect cryptographic keys while the commerce systems used to sell it still expose the identity and location of its owner.
The wallet stayed secure while the customer identity layer failed
SafePal traced the incident to an authorization flaw in a plugin used for order tracking. Under certain conditions, one customer’s order information could be accessed without authorization. The company said it fixed the issue after discovering it and introduced additional security measures.
… Continue reading the full article at the original source below.
