crypto wallet maker SafePal has disclosed a security incident that exposed personal order data belonging to roughly 39,798 customers, the company said in a statement released Sunday.
According to SafePal, the breach stemmed from an authorization flaw in a third-party plug-in used to track order status. The flaw allowed outside parties to view another customer’s order details simply by altering the order number in the system. Affected records cover purchases made between March 2, 2025, and April 11, 2026, and include names, email addresses, phone numbers, shipping addresses and purchase details.
The company was clear about what wasn’t touched: seed phrases, private keys, wallet passwords, bank account numbers, payment card data and government-issued ID numbers were not part of the exposure. SafePal said there is no evidence any customer funds were directly compromised as a result.
Notably, signs of trouble surfaced well before the formal disclosure. A Reddit user reported in early July being contacted by someone who appeared to know their name, address, phone number and prior order history — details later traced to the same vulnerability. SafePal said it investigated at the time but did not find evidence of a breach, only pinpointing the root cause more recently.
Since identifying the issue, SafePal says it has patched the flaw, added extra security controls, and taken down more than 30 fraudulent websites and phishing links built around the leaked data. The company is also limiting how long it retains customer order data going forward — cutting retention in its order-processing system to 90 days — and is urging affected users to watch for phishing attempts impersonating SafePal support, including fake firmware-update requests or refund offers.
The disclosure lands the same week Trezor, a rival hardware wallet maker, confirmed a separate breach at its shipping partner ShipMonk that exposed order data for roughly 13,700 customers — underscoring a broader pattern of hardware wallet firms being hit not through their core custody technology, but through the everyday web infrastructure — plug-ins, shipping vendors, order-tracking tools — that supports it.
