Cryptocurrency hardware wallet provider SafePal has confirmed a data breach affecting approximately 39,798 customers after attackers exploited an authorization flaw in an order-tracking plugin connected to customer order information.
The exposed data included names, email addresses, shipping addresses, phone numbers, and purchase details for customers who placed orders between March 2, 2025, and April 11, 2026. SafePal says the incident did not expose seed phrases, private keys, wallet passwords, payment-card numbers, bank details, or government-issued IDs.
What Happened
According to SafePal, the breach was caused by an authorization flaw in an order-tracking function used by a plugin associated with customer order information. Under certain conditions, the flaw allowed unauthorized access to another customer’s order data. SafePal says it fixed the issue after discovery and added extra security measures.
The affected data belongs to customers who ordered SafePal hardware wallets during a period spanning more than a year. SafePal notified affected customers by email on August 16, 2026, using the subject line “[Important] Your SafePal Order Information Has Been Affected.”
The company has also created a dedicated incident and scam-protection page where customers can verify whether they are affected using their order ID and shipping country.
What Data Was Exposed
The breach involved order-related customer information, including:
- names
- email addresses
- phone numbers
- shipping addresses
- purchase details
SafePal emphasized that the wallet itself was not compromised. The company said the incident was limited to the order-tracking plugin and was independent of SafePal’s wallet systems. It also stated that there is no evidence the incident compromised access to user wallets or funds.
That distinction matters, but it does not make the breach harmless.
For hardware wallet users, the combination of a name, phone number, address, and purchase history can be highly sensitive. It identifies people who may own crypto assets and shows where they may physically receive wallet-related products.
Why This Is Dangerous
A crypto wallet customer list is different from a normal e-commerce leak.
If attackers know that someone purchased a hardware wallet, they can assume the person may hold digital assets. That information can be used for targeted phishing, scam calls, fake firmware updates, fake refund messages, replacement-device scams, and even physical intimidation.
SafePal warned affected users to expect more sophisticated phishing and impersonation attempts, including fraudulent phone calls, emails, text messages, letters, refund offers, fake support messages, malicious websites, and fake firmware-update requests.
The risk is not limited to online scams. Decrypt noted that leaks involving names, phone numbers, and physical addresses of crypto wallet users raise concerns about physical targeting, especially as attacks against crypto holders have increased.
The Wallets and Funds Are Not the Main Issue
SafePal’s core message is that private keys and seed phrases were not exposed.
That is important because SafePal is a non-custodial wallet provider. The company says it does not store or collect seed phrases, private keys, wallet passwords, or other wallet credentials.
However, attackers do not need to steal private keys directly if they can trick users into handing them over.
A realistic phishing message might claim:
- your wallet needs a security update
- your device must be replaced
- your order was affected and needs verification
- your assets are at risk
- you must enter your recovery phrase to secure funds
- SafePal support needs to validate your wallet
All of these should be treated as scams.
SafePal states clearly that it will never ask users for a recovery phrase, private key, PIN, or wallet password.
A Delayed Discovery Timeline
One concerning detail is the timeline.
According to The Block, SafePal said it received the first report consistent with the breach in early May but initially treated it as an isolated case. The company later escalated the issue, began a full review and rebuild of its order-processing pipeline in July, and confirmed the root cause during the investigation.
SafePal also said a scheduled data-cleanup process had stopped working correctly between September 2025 and April 2026 due to a configuration error. That issue did not cause the unauthorized access, but it meant older order records remained available longer than intended, extending the affected period back to March 2025.
This is a key lesson for any company handling sensitive customer data: retention failures can increase the blast radius of a breach, even when they are not the original vulnerability.
SafePal’s Response
SafePal says it has fixed the authorization flaw, strengthened access controls, and reduced the retention period for personal information in the relevant order-processing environment to 90 days, subject to legal requirements.
The company also says it is engaging an independent third-party security firm to validate the fix and conduct a broader review of its order-processing systems. SafePal has opened a dedicated support channel for affected customers and says it has already taken down more than 30 fraudulent websites and phishing links tied to scam activity.
Part of a Wider Hardware Wallet Problem
SafePal is not the only hardware wallet company facing customer-data exposure concerns.
The Block reported that SafePal’s disclosure followed recent incidents affecting other wallet providers, including a Trezor shipping-provider breach that exposed information belonging to nearly 14,000 customers.
This pattern shows that the weakest point in hardware wallet security is not always the device.
Sometimes it is the commerce layer: order tracking, shipping partners, support portals, plugins, logistics systems, CRM tools, and customer databases.
For attackers, that data can be enough to launch convincing follow-on attacks.
What SafePal Customers Should Do
Affected customers should be cautious, even if their wallet funds remain secure.
Recommended actions:
- Never share your seed phrase or private key.
No legitimate SafePal employee, support agent, courier, exchange, or wallet provider should ever ask for it. - Do not click links in unexpected emails or texts.
Type SafePal’s official website address manually instead of following links. - Ignore fake firmware-update messages.
Only use official SafePal channels and verified applications. - Treat unexpected calls or letters as suspicious.
SafePal says its employees will not initiate phone calls to customers and will never send physical letters asking users to scan QR codes or follow instructions. - Be careful with replacement-device scams.
Attackers may claim that your hardware wallet needs to be replaced and direct you to a fake support page. - If you entered your seed phrase anywhere, move funds immediately.
SafePal advises users who have shared or entered their recovery phrase or private key in response to a suspicious message to treat that wallet as compromised, create a new wallet, and move remaining assets.
What Companies Should Learn
This incident is a reminder that customer order data can be as sensitive as account data in the crypto industry.
Hardware wallet vendors and crypto companies should treat order-processing systems as high-risk infrastructure. That means:
- strict authorization checks on all customer records
- regular plugin and integration security reviews
- short retention periods for sensitive order data
- monitoring for cross-customer access attempts
- rapid escalation of phishing reports
- security testing of order-tracking and support tools
- vendor and logistics partner audits
- clear incident-response and disclosure processes
If a customer database identifies people as crypto holders, it becomes a target.
Final Thoughts
The SafePal breach did not expose wallet seed phrases, private keys, or funds directly. But it did expose information that can help criminals target crypto users with highly believable scams.
For affected customers, the main danger now is follow-on abuse: phishing, fake support, fake firmware updates, refund scams, malicious websites, and potentially physical targeting.
In crypto, protecting the wallet is not enough. Companies must also protect the customer journey around the wallet — orders, shipping, support, plugins, and third-party integrations — because attackers can turn that metadata into a powerful weapon.
