SafePal Data Breach Exposes 40,000 Customers-Are Wallets Still Safe?

Nearly 40,000 customers of crypto wallet maker SafePal now have to watch their inboxes a little more closely. The company disclosed on August 16 that a flaw in its order-tracking system had exposed personal information tied to roughly 39,798 customer accounts, marking one of the more significant SafePal data breach disclosures to hit the hardware wallet industry this year. The good news, according to SafePal, is that the breach never touched the credentials that actually protect crypto funds.

Key takeaways

• An authorization flaw in SafePal’s order-tracking plugin exposed personal data tied to approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.
• Exposed information includes names, email addresses, phone numbers, shipping addresses, and purchase details — but not seed phrases, private keys, wallet passwords, payment card numbers, bank details, or government IDs.
• SafePal says there is no evidence that customer wallets or funds were directly compromised by the breach itself.
• The company has taken down more than 30 phishing websites tied to the incident and cut personal data retention to 90 days.
• SafePal is hiring an independent third-party security firm to audit its fix, following similar recent data exposures at Trezor and Ledger.

What Triggered the SafePal Data Breach

The root cause was an authorization defect in a plugin SafePal used to track customer orders. Under certain conditions, that flaw let one customer view another customer’s order information simply by manipulating an order number — similar to a delivery tracking page that accidentally lets a stranger pull up someone else’s receipt.

… Continue reading the full article at the original source below.