SafePal Says 39,798 Customers Hit by Data Breach
Crypto wallet maker SafePal disclosed a breach exposing order data of 39,798 customers via a plugin authorization flaw; keys and seed phrases unaffected.
SafePal, a Singapore-based cryptocurrency security company, said an authorization flaw in an order-tracking plugin let attackers access order records placed between March 2, 2025 and April 11, 2026. Exposed data includes names, emails, addresses, phone numbers, and purchase details for about 39,798 customers, while seed phrases, private keys, wallet passwords, and payment data were not exposed. A threat actor advertised the same dataset on a cybercrime forum, and affected customers were notified by email on August 16. The company patched the flaw, reduced data retention to 90 days, and removed over 30 fraudulent phishing websites.
- Authorization flaw in order-tracking plugin exposed order data for 39,798 customers
- Stolen data is being advertised on a cybercrime forum
- Wallet credentials, seed phrases, and payment information were not affected
- More than 30 fraudulent phishing websites identified and removed
- Vendors
- SafePal
- Products
- SafePal hardware wallets
- Victims
- SafePal
- Organizations
- SafePal
- Countries
- Singapore
From the original article
3 min read at securityaffairs.com
SafePal says a breach exposed personal data of 39,798 customers, but not wallet credentials, private keys, seed phrases, or payment information. SafePal disclosed a data breach affecting about 39,798 customers after hackers exploited a vulnerability in its order-tracking plugin.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.