- Crypto wallet provider SafePal has confirmed a data breach affecting 39,798 customers, exposing personal and order information.
- A flaw in an order-tracking plugin caused the breach, giving unauthorized access to customer records placed between March 2025 and April 2026.
- No seed phrases, private keys, or crypto funds were compromised, but experts warn the exposed data is enough to fuel targeted scams.
SafePal, a popular crypto wallet provider, just confirmed that a data breach exposed the personal information of 39,798 customers. The company disclosed the incident after identifying an authorization flaw in a plugin it used to track customer orders.
That flaw allowed unauthorized parties to access other customers’ order data through the tracking system. The affected orders cover a window stretching from March 2, 2025, to April 11, 2026.
The exposed data includes customers’ names, email addresses, phone numbers, shipping addresses, and purchase details. SafePal has made clear that the breach did not touch seed phrases, private keys, wallet passwords, payment card details, or cryptocurrency funds.
According to the report, no funds, keys, or seed phrases were affected. In simple terms, the breach hit the information around customers’ purchases, not the credentials that control their actual wallets.
What Got Exposed and Why It Matters
Even without crypto credentials in the mix, the leaked data still creates a serious problem. An attacker who knows a victim’s full name, home address, phone number, and exact SafePal purchase has enough to run a very convincing scam. They could pose as SafePal support and ask the victim to update their firmware, verify their account, or move their funds to a “safe” address.
The Next Web flagged the exposure of physical home addresses as especially worrying, given the nature of SafePal’s customer base. Crypto wallet owners are a high-value target. Knowing someone bought a hardware wallet tells an attacker exactly what kind of assets that person likely holds.
Reports on X showed users reacting quickly to the disclosure. Some complained about receiving spam calls shortly after the news broke. Others pointed to a string of recent data exposures hitting hardware wallet providers. Individual social media reports cannot confirm a direct link to the SafePal breach, but the timing has drawn concern across the crypto community.
There are also reports that a threat actor is offering the stolen data for sale on underground forums. That claim has not been independently verified and should be treated as an allegation, not confirmed fact. Help Net Security and other outlets have reported the alleged sale while being clear that it remains unverified.
How SafePal is Responding
SafePal says it has already fixed the authorization flaw that caused the breach. The company also brought in an independent security firm to check and confirm that the fix actually works. Beyond that, SafePal says it identified and removed more than 30 fake websites and phishing links connected to the incident.
The company has also changed how long it keeps customer information. According to reports, SafePal has now cut its personal data retention period down to 90 days. The goal is to reduce how much customer data sits available if another security incident ever occurs.
The phishing infrastructure SafePal is defending against continues to evolve. Researchers have documented a phishing kit that supports 17 wallet brands, features a built-in administration panel, and can send stolen seed phrases directly to attackers via Telegram or email. SafePal also reached out directly to all affected customers to notify them about the breach.
A Bigger Warning for Crypto Users
The SafePal breach is a reminder that protecting crypto users goes beyond locking down their funds. Private keys and seed phrases staying safe is good. But exposed personal details can still hand attackers everything they need to run targeted scams against crypto holders.
Someone who receives a call from a person who knows their name, address, and the exact wallet they bought will find it very hard to tell the difference between a real support agent and a scammer. That is the real danger here, and it does not require any access to a single coin or token.
Affected customers should stay alert to any unexpected calls, emails, or messages claiming to be from SafePal. They should avoid clicking links sent through unsolicited messages and should go directly to SafePal’s official website for any account-related actions.
Anyone who receives suspicious contact claiming to be from SafePal support should treat it with caution, especially if the caller asks for account information, wallet credentials, or fund transfers of any kind.
