SafePal Data Breach Exposes Information of Nearly 40,000 Customers

Crypto wallet provider SafePal has disclosed a security incident involving customer order information, raising fresh concerns about data privacy in the cryptocurrency industry even as the company says there is no evidence that users' crypto wallets or funds were compromised.

According to the details provided by SafePal, the incident involved an authorization flaw in a third-party order-tracking plugin. The vulnerability allowed unauthorized parties to access information associated with customer orders.

Approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026, were reportedly affected.

The exposed information included customer names, email addresses, shipping addresses, phone numbers and purchase-related details.

SafePal said the incident did not expose some of the most sensitive information associated with its cryptocurrency wallet products. The company said seed phrases, private keys, wallet passwords, payment information and government-issued identification numbers were not affected.

It also said it found no evidence that attackers gained access to customers' cryptocurrency wallets or funds.

What Happened in the SafePal Data Breach

The incident centered on an authorization weakness in an order-tracking system.

Order-tracking tools are designed to allow customers to check the status of products they have purchased. In SafePal's case, the system is used for tracking hardware-wallet orders and related purchases. SafePal currently provides an online order-tracking service through its website.

The reported vulnerability did not appear to involve the core cryptographic security mechanisms protecting customers' wallets.

Instead, the issue was connected to customer information associated with purchases.

That distinction is important.

A cryptocurrency wallet provider can maintain strong protections around private keys and seed phrases while still facing cybersecurity risks in other parts of its business infrastructure.

For customers, however, the exposure of personal and shipping information can still present meaningful risks.

Nearly 40,000 Customers Were Affected

The reported number of affected customers stands at approximately 39,798.

The affected period covers orders placed between March 2, 2025, and April 11, 2026.

That means the incident potentially involves more than a year of customer-order activity.

The exposed information reportedly included names, email addresses, phone numbers and shipping addresses, along with purchase information.

For hardware-wallet customers, shipping information can be particularly sensitive.

Someone who knows that an individual purchased a cryptocurrency hardware wallet may be able to infer that the person could hold or manage digital assets.

That does not mean the person has access to those assets, but the information could potentially be useful for targeted phishing, impersonation or social-engineering attempts.

SafePal Says Crypto Funds Were Not Compromised

One of the most important points in SafePal's disclosure is what was not exposed.

The company said there was no evidence that seed phrases, private keys or wallet passwords were compromised.

It also said payment information and government-issued identification numbers were not affected.

SafePal further reported that it found no evidence of unauthorized access to customers' wallets or cryptocurrency funds.

That means the incident, based on the company's disclosure, should be viewed primarily as a customer-data exposure rather than a confirmed cryptocurrency theft.

SafePal's products are designed to provide self-custody for digital assets, and its official website describes its hardware wallets as security-focused devices for managing cryptocurrency across multiple blockchain networks.

Nevertheless, customers should not assume that a data breach involving personal information is harmless.

Why Shipping Information Matters for Crypto Users

The cryptocurrency industry has a unique security problem.

A stolen email address is generally inconvenient.

A stolen home address combined with information showing that someone purchased a hardware wallet can create a more targeted security risk.

Attackers could potentially use leaked information to create convincing messages pretending to be SafePal, a delivery company, a cryptocurrency exchange or another service.

For example, a customer who recently purchased a SafePal device could receive a fraudulent email claiming that a shipment has been delayed and asking the recipient to confirm information through a malicious website.

The attacker would already possess enough legitimate information to make the message appear credible.

This is why cybersecurity experts frequently emphasize that users should treat unexpected messages involving cryptocurrency accounts, wallet devices and shipping information with caution.

SafePal Has Faced Security Scrutiny Before

Security has long been a major focus for SafePal because its products are designed to protect cryptocurrency assets.

The company has previously responded publicly to security research involving its hardware wallets.

In an earlier response to findings from Kraken Security Labs, SafePal said sensitive wallet information stored on its hardware device was protected through encryption and described security mechanisms designed to protect private keys and wallet data.

The latest incident is different in nature.

It involves customer-order infrastructure rather than evidence that the cryptographic protections securing wallet assets were defeated.

That difference illustrates a broader cybersecurity challenge: protecting a cryptocurrency ecosystem requires more than securing the blockchain or hardware device itself.

Websites, databases, customer-support systems, order-management platforms and third-party services can all become potential targets.

Source: Xpost

Third-Party Systems Can Create New Risks

The reported authorization flaw also highlights the risks created by supporting software and external plugins.

Companies frequently rely on third-party tools to provide functions such as order tracking, customer support, analytics and payment processing.

These services can improve the customer experience, but they also introduce additional components that must be secured and monitored.

An authorization flaw can be particularly serious because it may allow a user or attacker to access information that should belong only to another account.

In this case, the reported exposure was associated with order information rather than wallet credentials.

Still, the incident demonstrates why access controls are critical even for seemingly ordinary features such as package tracking.

What SafePal Customers Should Watch For

Customers who purchased SafePal products during the affected period should remain alert for suspicious communications.

Users should be particularly cautious about messages asking them to provide seed phrases, private keys, wallet passwords or other sensitive information.

SafePal has previously warned its community that legitimate team members will not ask users for their seed phrases or direct them toward malicious applications.

The safest approach is to avoid clicking unexpected links and independently navigate to the company's official website when checking an order or seeking support.

Customers can also consider strengthening the security of the email accounts associated with their purchases by using unique passwords and multi-factor authentication where available.

The Bigger Issue for the Crypto Industry

The SafePal incident highlights a difficult reality for the cryptocurrency sector.

Blockchain technology can provide strong security for digital assets, but companies operating around that technology still depend on conventional internet infrastructure.

A hardware wallet may protect private keys with sophisticated security mechanisms, yet customer information can still be exposed through an unrelated web application.

That creates a distinction between asset security and personal-data security.

Both matter.

A customer may not lose a single Bitcoin or Ethereum token following a data breach, but leaked information can still create opportunities for scams, phishing and targeted attacks.

As cryptocurrency adoption grows, companies will increasingly hold large amounts of customer information alongside financial products.

That makes cybersecurity and privacy just as important as protecting the underlying blockchain assets.

@coinbureau Draws Attention to the Incident

The SafePal disclosure has also attracted attention across the cryptocurrency community, including discussion on X involving @coinbureau.

The account has frequently covered major developments involving cryptocurrency wallets, security and the broader digital-asset industry.

The incident is particularly relevant to crypto users because it demonstrates why security should extend beyond private keys and seed phrases.

Even when customer funds remain safe, leaked personal information can create a new layer of risk.

What Happens Next

SafePal's disclosure provides some reassurance by stating that there is no evidence of compromised wallet access or stolen customer funds.

However, the exposure of information belonging to nearly 40,000 customers remains significant.

The incident will likely increase scrutiny of the security controls surrounding cryptocurrency companies' e-commerce platforms and third-party services.

For affected users, the priority is vigilance.

Customers should be skeptical of unexpected communications, verify the source of any support request and never disclose their seed phrase or private keys.

For the wider crypto industry, the lesson is equally clear.

Security cannot stop at the wallet.

Every system that handles customer information can become part of the attack surface, including order-tracking tools that may appear relatively harmless.

As SafePal works to address the incident, the episode serves as another reminder that protecting digital assets requires a comprehensive approach to cybersecurity, privacy and customer data.