SafePal Data Breach: Authorization Flaw Exposes Data of Nearly 40,000 Customers

SafePal, a hardware wallet maker, has disclosed an authorization flaw in an order-tracking plug-in that exposed the personal information of approximately 39,798 customers. The exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details. The company stated that wallet credentials and financial information were not compromised, and there is no evidence that wallets or funds were accessed.

The affected orders were placed between March 2, 2025, and April 11, 2026. SafePal attributed the extended exposure to a configuration error in a scheduled data-cleanup process that stopped working correctly between September 2025 and April 2026. The company has fixed the flaw, reduced data retention to 90 days, purged affected records from active servers, and engaged an independent third-party security firm to validate the fix. Additionally, over 30 fraudulent websites and phishing links have been taken down.

SafePal warned affected customers to be vigilant against phishing attempts, fraudulent calls, and fake support communications. The company has published a status-check page and a dedicated support channel. A threat actor has advertised the stolen dataset on a cybercrime forum, but SafePal has not yet commented on the listing.

This incident highlights the risks of data exposure in the cryptocurrency industry, where criminals view holders as high-value targets. SafePal has not reported any confirmed financial losses linked to the breach.