SafePal breach exposes 39,798 users' order records

TLDR

SafePal (SFP) has confirmed a data breach exposing customer order records for 39,798 users, while stating that wallets, seed phrases, and private keys remain secure.

1. An authorization flaw in SafePals order-tracking plugin exposed order data (names, contact, shipping, purchase details) for orders between March 2025 and April 2026.
2. No wallet credentials or funds were compromised, but affected users face elevated phishing and impersonation risk using highly personal information.
3. SafePal has patched the flaw, shortened data retention, and taken down phishing sites; the key thing to watch is phishing activity and any reports of resulting fund losses.

Deep Dive

1. What Was Exposed

Multiple reports state that SafePal disclosed an authorization flaw in an order-tracking system that allowed unauthorized access to customer order information for about 39,798 users who ordered hardware between 2 March 2025 and 11 April 2026. The exposed data includes names, email addresses, phone numbers, shipping addresses, and detailed purchase information, according to SafePals incident report and coverage by outlets such as CoinDesk. This weakness was in the e-commerce order infrastructure, not in the wallet app or hardware itself.

2. Impact On Users And Wallet Security

SafePal states that seed phrases, private keys, wallet passwords, bank account numbers, payment card data, and government IDs were not part of the breached dataset, and it reports no evidence that wallet access or funds were directly compromised. The main risk is targeted phishing: attackers can use real names, addresses, and order details to craft convincing fake support emails, refund offers, or firmware-update messages, as highlighted in detailed coverage by crypto.news. SafePal has warned that it will never ask for users recovery phrases, PINs, or private keys and advises treating any wallet as compromised if those were ever shared with a suspicious site or contact.

3. How SafePal Responded And What To Watch

SafePal says it has patched the plug-in flaw, added extra access controls, and engaged an independent security firm to audit the fix and its broader order-processing pipeline. It has reduced personal-data retention in the affected systems to 90 days and removed over 30 fraudulent websites linked to related phishing attempts, while emailing all known affected customers and offering a tool to check whether a given order was impacted. For the wider hardware wallet ecosystem, this incident joins prior shipping and customer-data breaches at other providers, underscoring that even cold storage vendors must harden their ancillary systems. The next meaningful signals will be whether sophisticated phishing campaigns increase and whether any confirmed fund losses are traced back to misuse of this leaked data.

Conclusion

The SafePal breach exposed sensitive customer order records but, based on current disclosures, stopped short of touching seed phrases, private keys, or wallet funds. Its real danger lies in making phishing and impersonation more credible, which puts the burden on users to be extremely cautious with any communication referencing their SafePal purchases. For crypto users, the lesson is to separate wallet secrets from all customer-support channels and treat e-commerce and shipping systems as distinct, potentially weaker links in the security chain.