SafePal discloses breach of 39,798 orders

TLDR

SafePal has confirmed a data breach exposing order information for 39,798 hardware wallet customers, but says wallet keys and crypto funds remain unaffected.

1. The breach stems from an authorization flaw in SafePals order-tracking plugin that allowed access to names, emails, shipping addresses, phone numbers, and purchase details for orders between March 2025 and April 2026.
2. The main risk is not stolen crypto, but highly targeted phishing and impersonation attacks using leaked personal data, with SafePal stressing that seed phrases and private keys were not accessed.
3. SafePal has patched the flaw, cut data retention to 90 days, removed phishing sites, and launched a checker tool, while advising affected users to treat any suspicious messages carefully and never share recovery phrases or keys.

Deep Dive

1. Breach Scope And Cause

SafePal reported that an authorization flaw in a customer order-tracking plugin allowed unauthorized viewing of other customers order records, exposing data for about 39,798 customers who ordered between March 2, 2025 and April 11, 2026. Reports note that exposed fields include names, email addresses, shipping addresses, phone numbers, and purchase details, but not seed phrases, private keys, wallet passwords, bank details, or government IDs, according to SafePals incident disclosures and coverage such as this data breach report.

SafePal says its hardware wallets and on-chain assets remain secure because the cold storage architecture is isolated from e-commerce systems, meaning this was a customer-data leak, not a wallet compromise.

2. Phishing And Security Risk

Multiple outlets highlight that the primary danger is phishing and impersonation: attackers can now craft convincing messages referencing real orders and addresses, pretending to be SafePal support or logistics partners and offering refunds, firmware updates, or replacement devices to extract wallet credentials, as described in incident coverage.

SafePal explicitly states it will never ask for seed phrases, private keys, wallet passwords, or direct crypto transfers in support flows, and warns that anyone who entered such data into suspicious sites should treat their wallet as compromised and migrate funds to a new wallet.

3. SafePal Response And User Steps

SafePal says it has patched the vulnerable plugin, added stricter access controls, reduced storage of personal order data to 90 days, and removed more than 30 phishing domains tied to the scam, while engaging an independent security firm to review its order-processing systems, per post-incident details. A verification tool on SafePals site allows customers to check if their order was in the affected set, and impacted users were emailed directly.

For SafePal users, practical steps are: verify any contact through official channels, ignore unsolicited support messages, double-check domains before clicking, and immediately rotate wallets if sensitive information was ever shared with a suspicious site.

Conclusion

SafePals disclosure shows that even reputable hardware wallet providers can suffer customer-data breaches at the e-commerce layer, while keeping on-chain keys technically safe. The real impact is a higher risk of convincing phishing aimed at nearly 40,000 users, making careful handling of recovery phrases, private keys, and support interactions critical in the weeks ahead.