Hassan Maishera
TL;DR
-
An authorization flaw in SafePal’s order-tracking system exposed data belonging to approximately 39,798 customers.
-
Compromised information included names, email addresses, phone numbers, shipping addresses, and purchase details.
-
SafePal said seed phrases, private keys, wallet passwords, payment information, and customer funds were not affected.
Crypto wallet provider SafePal has disclosed a security incident that exposed the personal information of approximately 39,798 customers.
Dear community,
— SafePal - Crypto Wallet (@SafePal) August 16, 2026
While your SafePal wallet, seed phrase, and private keys are secure; we identified a flaw in the order-tracking plug-in that led to unauthorized access to information of a subset of customers.
The issue has been fixed with additional security measures…
In an incident report published on Sunday, SafePal said an authorization vulnerability in its order-tracking system allowed unauthorized parties to access customer records.
The affected data relates to purchases made between March 2, 2025, and April 11, 2026. Exposed information included customer names, email addresses, telephone numbers, shipping addresses, and order details.
SafePal stressed that the incident did not expose seed phrases, private keys, wallet passwords, or other wallet credentials. Bank account information, payment card numbers, and government-issued identification details were also unaffected.
The company said it had found no evidence that the vulnerability directly compromised SafePal wallets or resulted in unauthorized access to customer funds.
SafePal Warns Customers About Targeted Phishing Attacks
Although wallet credentials were not exposed, the leaked information could enable highly convincing phishing and impersonation attacks.
SafePal warned affected customers that scammers may pose as company employees and refer to genuine purchase details to appear legitimate. Attackers could offer fake refunds, firmware updates or replacement hardware wallets before directing customers to fraudulent websites designed to steal their credentials.
Customers should treat unsolicited messages cautiously and avoid sharing seed phrases, private keys or passwords under any circumstances. Legitimate wallet providers do not need this information to process refunds, provide technical assistance or replace devices.
SafePal has not revealed when the vulnerability was introduced, when unauthorized access first occurred, or how many attackers may have obtained the records.
SafePal said it received the first report potentially connected to the breach in early May. The company initially handled the complaint as an isolated incident.
It later escalated the investigation and began reviewing and rebuilding its order-processing infrastructure in July. SafePal said the investigation subsequently identified the authorization flaw as the root cause of the data exposure.
Public complaints suggesting that customer information had been compromised appeared before the company’s formal disclosure.
A Trustpilot review posted on July 4 alleged that scammers impersonating SafePal contacted a customer while possessing detailed account information. The attackers reportedly directed the customer to a fraudulent website using the domain safepal.support and offered a replacement hardware wallet.
A Reddit user reported a similar incident on July 3, claiming that a caller knew their name, address, telephone number, email address, and details from an earlier SafePal purchase. The caller allegedly directed the user to the same fraudulent website.
Blockchain analyst Specter later highlighted both complaints on X. However, The Block said it could not independently establish whether the accounts were directly connected to SafePal’s breach.
Responding to Specter, SafePal said it had investigated the reports at the time but had not discovered evidence of a breach.
Over 30 Fraudulent Websites Taken Down
SafePal said it has identified and removed more than 30 phishing links and fraudulent websites associated with the scam.
The company has not confirmed whether any customers lost cryptocurrency as a result of the impersonation campaign. It said it was contacting asset-tracing specialists and asked affected users to report losses through its official support channel.
SafePal’s disclosure follows similar customer-data incidents involving other hardware wallet providers and their commerce partners.
A breach affecting Trezor’s shipping partner, ShipMonk, recently exposed information belonging to nearly 14,000 customers.
Full names, telephone numbers, and shipping addresses were exposed for 11,742 people, while another 1,947 customers had their names, cities, and email addresses exposed.
SafePal described the timing of its disclosure shortly after Trezor’s announcement as an unfortunate coincidence.
Ledger also notified customers in January that names and contact details had been exposed through Global-e, a third-party commerce provider that processed some purchases from its website.
In all three cases, the wallet providers said private keys and wallet infrastructure remained secure.
Nevertheless, exposed customer and order information can create serious secondary risks by allowing criminals to design personalized phishing attacks against cryptocurrency holders.
