SafePal breach exposes data of 39,798 customers

TLDR

SafePal (SFP) has confirmed a data breach involving order information for 39,798 customers, but says wallet keys and crypto funds remain unaffected.

1. An authorization flaw in an order-tracking plugin exposed names, emails, shipping addresses, phone numbers, and purchase details for customers who ordered between March 2025 and April 2026.
2. The main risks are highly targeted phishing, impersonation, and potential physical threats, not direct on?chain theft, though the leak links real-world identities to crypto ownership.
3. SafePal has patched the flaw, shortened data retention, removed phishing sites, and opened verification/support channels; users should watch for follow-up findings and any signs the leaked data is being abused.

Deep Dive

1. Breach Scope And What Was Exposed

SafePal disclosed that an authorization flaw in its order-tracking system allowed attackers to view other customers order details by manipulating order numbers, affecting about 39,798 customers who placed orders between 2 Mar 2025 and 11 Apr 2026. Reports say exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details, but not seed phrases, private keys, wallet passwords, bank or card data, or government IDs, according to SafePals incident statement and coverage from outlets such as CoinDesk.

SafePal stresses that its wallet infrastructure and cold storage remain separate from the affected e-commerce systems, and that there is no evidence of wallets or funds being directly compromised.

2. Risks For Affected Users

Because the leak combines personal identity data with evidence of crypto hardware wallet purchases, the primary risks are:

1. Sophisticated phishing and impersonation, where attackers pose as SafePal support or security contacts offering refunds, firmware updates, or replacements to trick users into revealing seed phrases or private keys.
2. Social engineering using accurate order details and addresses, making scam messages, calls, or letters seem legitimate.
3. In extreme cases, an elevated risk of physical targeting (wrench attacks) for users whose home addresses and crypto ownership are now linked.

3. SafePals Response And What To Watch

SafePal says it has patched the plugin flaw, implemented extra access controls, cut personal data retention to 90 days, and hired a third?party security firm to audit the fix. It has emailed affected customers individually, taken down more than 30 phishing sites, and published a verification tool on its site so users can check whether their order was exposed.

For crypto users, the key things to watch are: further disclosures about how the data has been used in real-world scams, any regulatory or legal scrutiny of SafePals data-handling practices, and whether other hardware wallet vendors harden their e-commerce and logistics systems in response to this and similar breaches.

Confidence: high multiple independent reports and SafePals own incident notice align on the core facts and scope.

Conclusion

This breach is not about wallets being hacked, but about the dangerous link between personal identity, physical addresses, and evidence of crypto holdings. For affected SafePal users, the main threat is now social engineering and potential physical targeting, not immediate on-chain loss. The broader lesson for the crypto space is that hardware wallet security must include the boring surrounding systems order tracking, logistics, and data retention because those can be the weakest link even when private keys remain cryptographically safe.