Breach at Crypto Wallet Company Called ‘SafePal’ Exposes 39,798 Customers

Hardware wallets like SafePal’s are, funnily enough, supposed to be safeguards. They’re air-gapped, and therefore theoretically un-hackable resources for sequestering the crucial information needed to perform blockchain transactions. In other words, your phone or computer can be hacked to high heaven, but if you have a hardware wallet—and excellent security hygiene—at least your crypto will stay safe.

So given that SafePal customers’ actual crypto is still locked up, the issue is that, as SafePal notes, “affected customers might be targeted by more sophisticated phishing attempts.” This phishing possibility is evidently a big deal for SafePal, because the FAQ page for users potentially exposed in this breach has a giant warning about phishing at the top, featuring the hashtag #BewareOfPhishing.

Think about it: someone might have the phone numbers and email addresses of 39,798 people who own enough crypto to buy hardware wallets, and those wallets themselves are the keys to all those potential fortunes. It follows that with a little social engineering, customized perhaps with real names and a bit of regional specificity, attackers probably think they can pry those holdings out of at least a handful out of thousands of targets.

Such an attack would be easier—or at least less bloody—than what’s sometimes known as a “$5 wrench attack,” an increasingly prominent form of crime in which an attacker wielding a blunt object, or more likely a gun, shows up and demands the key info that unlocks your crypto.

Stay, uh, safe out there, pals.