SafePal data breach exposes nearly 40,000 crypto wallet customers

If you own a crypto hardware wallet and the name SafePal just popped up in your feed, here is what is going on: the company disclosed on Sunday that a data breach exposed the personal information of 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.

SafePal is a cryptocurrency security company that makes physical hardware wallets and software applications designed to help investors store and manage digital assets. The breach did not touch anyone’s crypto holdings, but it did spill names, physical addresses and contact details, the kind of information scammers can use to craft convincing phishing emails and impersonation schemes.

An order-tracking flaw opened the door

CoinDesk reported that SafePal traced the breach to an “authorization flaw” in a plug-in used to track customer orders. The flaw likely allowed an attacker to view other customers’ order receipts and delivery details simply by changing an order number. Think of it as a store’s parcel-tracking page letting one buyer peek at another buyer’s receipt.

The company stressed that the core security of its wallets remains intact. No cryptocurrency funds, seed phrases, private keys, bank passwords, payment card numbers or government-issued IDs were compromised. Still, SafePal warned that exposed users face heightened phishing and impersonation risks.