SafePal breach affects 39,798 customers, data allegedly for sale

Cryptocurrency wallet maker SafePal disclosed a data breach that exposed order information for 39,798 customers, including names, email addresses, shipping addresses, phone numbers and purchase details.

The company traced the exposure to an authorization flaw in a plug-in used for order tracking. Under certain conditions, the flaw let one customer view another customer’s order information.

The exposure covers orders placed between March 2, 2025 and April 11, 2026.

SafePal received a report consistent with the issue in early May and treated it as an isolated case at the time, before escalating it into a formal security investigation and introducing additional protections.

One customer wrote on X about receiving a suspicious email, a letter, and a phone call in May from someone claiming to represent SafePal. The impersonator warned of a security issue with a recently purchased hardware wallet and directed the customer to click a link to fix it. The customer then contacted SafePal and was told the communication did not come from the company.

Although there is no confirmed connection between the data exposure and the phishing attempt, the timing and the information available to the impersonator overlap with the data SafePal says was exposed.

SafePal confirmed that seed phrases, private keys, wallet passwords, bank account information, payment card numbers and government-issued identification numbers were not exposed.

“No evidence has been found that the incident itself compromised access to SafePal wallets or funds,” the company noted.

“However, affected order information may be used for targeted phishing and impersonation attempts, and we strongly encourage customers to remain vigilant.”

SafePal emailed affected customers individually on August 16 from [email protected], with the subject line “[Important] Your SafePal Order Information Has Been Affected.”

The company has since fixed the flaw, brought in an outside security firm to review the incident, and reduced its retention period for personal order data to 90 days. It has also taken down more than 30 phishing sites and fraudulent links tied to the incident and continues to monitor for new ones.

“You should not need to move your assets solely because your order information was affected. However, if you have already shared or entered your seed phrase or private key in response to a suspicious message, website, phone call, or letter, treat that wallet as compromised,” SafePal added.

Threat actor claims to have data from SafePal breach

According to DarkWebInformer, a threat actor is selling data on a cybercrime forum that is claimed to have come from the SafePal breach. The listing cites the same order window and customer count, 39,798, disclosed by SafePal.

The threat actor offered to share order IDs and shipping countries so potential buyers could check them using SafePal’s verification tool before purchasing the data, and added: “Not interested in low balls, please come correct and with a good price or do not message me at all.”

At the time of writing, there is no confirmation that the data offered for sale is authentic.

“Stay vigilant for any suspicious outreach or impersonations. Treat any unexpected contact or hardware delivery referencing your SafePal purchase as suspect, whether it arrives by phone, in the post, or in person,” SafePal warned.