Safepal Data Breach Exposes 39,798 Users

TLDR

SafePal, a non?custodial hardware wallet provider, has confirmed a data breach exposing personal order details for about 39,798 customers.

1. The breach came from an order?tracking plug?in flaw that exposed names, emails, phone numbers, shipping addresses, and purchase details between March 2025 and April 2026.
2. Wallet seed phrases, private keys, and funds were not touched, but combining home addresses with proof of hardware wallet ownership raises phishing and physical attack risk.
3. SafePal has patched the flaw, shortened data retention to 90 days, notified affected users, and launched a verification tool, but users should stay alert for targeted scams and impersonation.

Deep Dive

1. What Happened And What Was Exposed

Multiple reports confirm that SafePal disclosed a security incident involving approximately 39,798 customers whose order information was accessed via an authorization flaw in an order?tracking plug?in used on its e?commerce systems, not the wallets themselves. The exposed records cover orders placed between 2 March 2025 and 11 April 2026 and include names, email addresses, shipping addresses, phone numbers, and purchase details, according to SafePals incident summaries and independent coverage of the data breach exposing 39,798 customers' order info.

Critically, SafePal states that no seed phrases, private keys, wallet passwords, bank account details, payment card numbers, or government IDs were involved, and there is no evidence that the incident itself granted direct access to any SafePal wallets or funds.

2. Main Risks For Affected Users

Because the leaked file links personal identity data and physical addresses with confirmed hardware wallet purchases, affected users face elevated phishing and impersonation risk, as well as the possibility of so?called wrench attacks where criminals threaten victims for their crypto. Coverage notes that attackers can use the exposed dataset to craft convincing refund offers, firmware?update notices, fake support sites, and fraudulent phone calls targeting SafePal owners. One report adds that records are already being advertised for sale on a cybercrime forum as a targeting list for phishing and robbery.

The good news is that the incident does not by itself allow attackers to move funds; they still need a seed phrase (the 12 or 24 recovery words) or private key. The danger is that tailored social engineering or physical pressure could trick or coerce users into revealing those secrets.

3. SafePals Response And What To Do

SafePal says it has patched the plug?in flaw, rebuilt parts of its order?processing pipeline, and reduced personal data retention on order systems to 90 days, as described in its detailed incident report and follow?up explaining reduced data retention and added access controls. The company has notified affected customers individually by email, deployed a verification page where users can check whether a given order was impacted, hired a third?party security firm to audit fixes, and taken down more than 30 phishing websites linked to the breach.

For users, the practical steps are: verify whether your orders were affected using SafePals official tool; treat any unsolicited calls, emails, texts, or sites mentioning the incident with suspicion; never enter your seed phrase, PIN, or private keys anywhere except your own wallet device; and if you already shared those secrets in response to a suspicious communication, immediately create a new wallet and move your assets.

Conclusion

This breach is about off?chain customer data rather than direct wallet compromise, but it meaningfully increases social?engineering and physical?security risk for nearly 40,000 identifiable SafePal buyers. The combination of home addresses, contact details, and proof of hardware wallet ownership is powerful targeting information, so the real impact will depend on how widely the dataset is traded and how users respond to scams. In the current environment of repeated wallet?related data leaks, self?custody remains viable, but it increasingly requires thinking about how your personal information is handled around each purchase, not just how your private keys are stored.