Data Breach Hits 39,798 Safepal Customers After Order Plugin Flaw

Key Takeaways

• Safepal suffered a data breach exposing the personal details and shipping addresses of 39,798 users.
• While wallet keys remain safe, the leaked addresses leave users vulnerable to physical wrench attacks.
• Safepal secured the flaw but faces harsh criticism for delaying disclosure despite prior scam reports.

Safepal Discloses New Customer Data Incident: Almost 40K Users Involved

Safepal, a wallet manufacturer headquartered in the Seychelles, is facing a security crisis involving a subset of its users.

On Sunday, the company disclosed that it had suffered an unauthorized data breach involving 39,798 customers after a plugin used for order tracking suffered a flaw that allowed unidentified actors to access this information.

The data breach involved customers’ orders between March 2, 2025, and April 11, 2026, exposing potentially critical information, including names, email addresses, shipping addresses, phone numbers, and purchase details, to the attackers.

The company ensured that seed phrase, private keys, wallet password, or other wallet credentials were not extracted during this incident.

Safepal acknowledged that the breach might lead to sophisticated phishing attempts, including “fraudulent phone calls, emails, text messages, letters, refund offers, firmware-update requests, fake customer-support communications, malicious websites, or other attempts to obtain your wallet credentials or additional personal information.”