SafePal Wallet Breach Exposes 40,000 Customers

TLDR

SafePal has confirmed a data breach affecting roughly 40,000 customers, exposing order information but not seed phrases or private keys.

1. An authorization flaw in an order-tracking plugin exposed names, emails, phone numbers, shipping addresses, and purchase details for about 39,798 SafePal customers.
2. Wallet credentials were not stored in the affected system, but the leaked data significantly raises phishing and even physical wrench attack risks for identifiable crypto holders.
3. SafePal has patched the flaw, tightened data retention, and set up tools for affected users, while the incident highlights broader hardware wallet security and privacy weaknesses to monitor.

Deep Dive

1. What Was Exposed And To Whom

SafePals official incident disclosure confirms that an authorization flaw in its order-tracking plug-in allowed unauthorized access to customer order information for purchases made between 2 Mar 2025 and 11 Apr 2026, covering about 39,798 customers worldwide, and exposing names, email addresses, shipping addresses, phone numbers, and purchase details such as specific hardware wallet orders. This is documented in SafePals own security update.

Multiple reports note the figure is almost 40,000 customers, with the leaked database now reportedly being offered on a cybercrime forum, where the seller validates records using order IDs and shipping country lookups against SafePals public checker, as detailed by The Defiant. The breach is limited to e-commerce data and does not include funds or on-chain transactions.

2. Keys Intact, But Risk Shifts To Phishing And Physical Threat

SafePal states that seed phrases, private keys, wallet passwords, bank details, payment card numbers, and government IDs were never collected in the affected system and were not exposed in the breach, emphasizing that no evidence has been found of wallet or fund compromise in its incident FAQ.

However, combining real names, phone numbers, home addresses, and specific wallet purchases materially increases the risk of targeted phishing, impersonation scams, and physical extortion, sometimes called wrench attacks, where criminals attempt to coerce victims into revealing their seed phrases. Recent coverage notes a broader trend of hardware wallet incidents, including large Bitcoin losses at Coldcard and data leaks at Trezor and Ledger, with Chainalysis tracking dozens of violent robberies against crypto holders in 20252026, as summarized in CryptoSlates analysis.

3. SafePals Response And What Users Should Do

SafePal says it has fixed the plugin flaw, reduced personal data retention in the order-processing environment to 90 days, engaged an independent security firm for audit, and taken down more than 30 phishing domains tied to the scam activity, all outlined in its security update. A dedicated web tool lets customers check if their order ID and shipping country appear in the affected set, and affected users have been emailed from an official security address.

For users, key practices are: never share seed phrases or private keys under any circumstances; treat unsolicited calls, emails, refunds, firmware updates, or legal threats referencing your SafePal order as suspicious; access SafePals site by typing the URL yourself instead of following links in messages; and, if you ever disclosed a recovery phrase to a suspected scammer, treat that wallet as compromised and migrate funds to a new wallet you control.

Conclusion

The SafePal breach shows that even non-custodial hardware wallets depend on surrounding web infrastructure and data-handling practices that can fail, turning order records into targeting tools for attackers. While private keys and seeds remain technically secure, linking personal identity to proven crypto hardware ownership shifts risk toward phishing and physical coercion. For crypto users, the lesson is clear: self-custody means protecting both keys and real-world privacy, with rigorous caution toward any party that tries to bridge the two.