SafePal breach exposes nearly 40,000 customer orders

TLDR

SafePal, a Binance-backed crypto wallet provider, has confirmed a data breach exposing order information for about 39,800 customers while stressing that wallets and private keys remain secure.

1. The breach leaked names, contact details and shipping addresses tied to orders placed between March 2025 and April 2026, but not seed phrases or funds.
2. The flaw was in an order tracking plug-in, and SafePal has patched it, shortened data retention and warned users about elevated phishing and impersonation risks.
3. For crypto users, the incident highlights that hardware wallets can keep keys safe even when e-commerce systems leak data, but vigilance against scams is critical.

Deep Dive

1. What Was Exposed And What Was Not

SafePal reported that an authorization flaw in its order tracking system allowed unauthorized access to customer order records for roughly 39,798 people who bought products between 2 Mar 2025 and 11 Apr 2026, including names, email addresses, phone numbers, shipping addresses and purchase details such as which hardware wallet was bought and when it was delivered. Multiple reports and SafePals own incident description agree that no seed phrases, private keys, wallet passwords, bank account information, payment card numbers or government IDs were exposed, and there is no evidence that wallet access or customer funds were compromised, since the hardware wallets operate in isolated cold storage environments separate from the e-commerce servers. This is a breach of personal data linked to orders, not of the cryptographic secrets that actually control users assets.

2. Risks And SafePals Response

SafePal warns that attackers can use the leaked contact and shipping information to craft convincing phishing and impersonation attempts, posing as SafePal support to offer refunds, firmware updates or replacement devices and then trying to trick users into revealing their seed phrases or private keys. In response, the company says it has fixed the plug-in flaw, implemented stricter access controls, removed more than 30 related phishing websites, notified all affected customers individually by email, and engaged a third-party security firm to review its order processing systems and the fix, as reported by outlets such as CoinDesk and crypto.news. SafePal has also reduced the retention period for order data in its systems to 90 days and provides a verification tool so buyers can check whether their orders were affected.

Confidence: high because independent media reports closely match SafePals incident summary.

3. Lessons For Crypto Users

This incident reinforces a key distinction in crypto security: the systems that store order and contact data are often separate from the hardware wallet architecture that generates and holds private keys, so a breach of one does not automatically compromise the other, but it does increase social engineering risk. SafePal reiterates that it will never ask for a users 12 or 24 word recovery phrase, PIN or private keys, and advises anyone who may have typed such data into suspicious sites or shared it with a supposed support agent to treat that wallet as compromised and move assets into a new wallet. More broadly, the breach sits alongside prior data incidents at other hardware wallet vendors and shows that users should monitor official channels for security notices, keep unique emails and phone numbers for crypto purchases where possible, and be wary of any unsolicited message referencing past orders.

Conclusion

SafePals breach exposed detailed order data for nearly 40,000 customers but, based on current evidence, did not touch the private keys or seed phrases that secure funds. The real impact is a higher risk of well crafted scams using genuine personal details, making disciplined handling of recovery phrases and careful verification of support communications more important than ever for hardware wallet users.