30
SafePal latest crypto hardware wallet maker affected by breach, with nearly 40,000 impacted
SafePal confirmed nearly 40,000 customers' order data was stolen, the third hardware wallet maker breached in a month after Trezor and Coinkite.
SafePal confirmed a breach exposing names, emails, shipping addresses, phone numbers, and purchase details of customers who ordered between March 2, 2025 and April 11, 2026, caused by a flaw in an order-tracking plugin. The company stressed wallets, seed phrases, and private keys remain secure, and all impacted customers were notified by email. A hacker advertised the stolen data on a dark web forum, and SafePal warned of targeted phishing via fake support calls and refund offers. CertiK data cited in the report shows 52 wrench attacks worldwide in H1 2026 with $124 million in losses, up 33% year-over-year.
55
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
SafePal disclosed an order-tracking plug-in authorization flaw exposing names, emails, addresses and purchase details of 39,798 hardware wallet customers; no wallet credentials affected.
Hardware wallet maker SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed names, email addresses, shipping addresses, phone numbers and purchase details of approximately 39,798 customers. No seed phrases, private keys, wallet credentials or financial information were exposed, and SafePal found no evidence of wallet or fund compromise. A separate configuration error left a data-cleanup process broken between September 2025 and April 2026, extending the affected order window back to March 2025. A threat actor has advertised a matching dataset on a cybercrime forum, and the company has fixed the flaw, cut data retention to 90 days, purged affected records, engaged third-party validators and taken down over 30 phishing sites.
48
30
45
30
30
30
30
Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider
Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.
Trezor confirmed that a breach at Brevo, its marketing email provider, exposed customer contact data and let hackers send roughly 347,000 phishing emails claiming a fake 'STM32 Entropy Vulnerability' and asking victims for their wallet backup password. Brevo said attackers accessed 138 accounts by abusing overly broad, improperly scoped access privileges. Trezor was also hit weeks earlier by a breach at shipping partner ShipMonk that exposed names, phone numbers, email addresses, and postal addresses of at least 81,000 wallet buyers. Trezor stated its own products, wallets, and account systems were unaffected and warned customers to expect further phishing attempts.
62
SafePal Data Breach Hits Tens of Thousands of Customers
A data breach at crypto hardware wallet maker SafePal has impacted the personal data of nearly 40,000 customers.
Infosecurity Magazine reports that a data breach at SafePal, a provider of cryptocurrency hardware wallets, has affected nearly 40,000 customers. The incident impacted tens of thousands of users of the wallet provider, though details on the attack vector and exact data types exposed were not provided in the source text. Customers of hardware wallet vendors are attractive targets given their association with cryptocurrency holdings.
50
30
30
30
30
35
SafePal Says 39,798 Customers Hit by Data Breach
Crypto wallet maker SafePal disclosed a breach exposing order data of 39,798 customers via a plugin authorization flaw; keys and seed phrases unaffected.
SafePal, a Singapore-based cryptocurrency security company, said an authorization flaw in an order-tracking plugin let attackers access order records placed between March 2, 2025 and April 11, 2026. Exposed data includes names, emails, addresses, phone numbers, and purchase details for about 39,798 customers, while seed phrases, private keys, wallet passwords, and payment data were not exposed. A threat actor advertised the same dataset on a cybercrime forum, and affected customers were notified by email on August 16. The company patched the flaw, reduced data retention to 90 days, and removed over 30 fraudulent phishing websites.
55
30
Trezor customers hit with phishing calls and letters after shipping-partner breach
A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.
SatoshiLabs, maker of Trezor hardware wallets, confirmed the August 2026 ShipMonk breach exposed names, emails, phone numbers, and shipping addresses for roughly 67,000 US customers who ordered between November 2019 and August 2021, on top of 3,889 customers affected initially. ShipMonk attributed the intrusion to attackers exploiting an SQLi zero-day in Metabase's Cloud SaaS platform and retained data past the 90-day deletion requirement. Trezor's own systems were not compromised; customers are reporting phishing calls and QR-code phishing delivered via physical letters.
50
30
45
30
Trezor warns users of email provider breach, phishing attacks
Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.
Trezor warned customers that threat actors breached its third-party email provider and sent fake 'Critical Security Alert: STM32 Entropy Vulnerability' emails from [email protected], claiming wallet seeds were exposed to brute-force attacks; the phishing domain has been taken down while Trezor investigates. This follows the ShipMonk breach, revised upward from about 14,000 to 81,000 customers (including 67,000 additional US customers) who received orders between May 10 and August 8, 2026. Attackers reportedly exploited a Metabase SQL injection zero-day to access ShipMonk data, and ShinyHunters sent extortion emails.
58
30
Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Attackers abused Brevo's SAML SSO to access 138 accounts, sending phishing emails to 347,000 Trezor customers and exfiltrating contacts from 43 accounts.
Trezor said 347,000 of its customers received phishing emails with the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' after the attacker compromised the Brevo marketing platform. Brevo said the intruder created an account, enabled SAML SSO, and used its own identity provider to access 138 accounts, exfiltrating contacts from 43 of them. Trezor reported 2,500 users clicked the malicious link before the site was taken offline 20 minutes after detection; potential fund losses are unknown. Swiss wallet maker BitBox and crypto tax calculator CoinTracking also appear affected, and Trezor separately disclosed a ShipMonk breach now affecting roughly 81,000 people.
65
SafePal breach affects 39,798 customers, data allegedly for sale
SafePal disclosed a breach exposing order data of 39,798 customers via an order-tracking plug-in flaw; the data appears for sale online.
Cryptocurrency wallet maker SafePal exposed names, phone numbers, addresses and purchase details for 39,798 orders placed between March 2, 2025 and April 11, 2026, due to an authorization flaw in an order-tracking plug-in. Seed phrases, private keys, wallet passwords, payment cards and government IDs were not exposed, and no wallet or fund compromise was found. A threat actor is selling data on a cybercrime forum citing the same order window and count, and SafePal has taken down more than 30 phishing sites and notified customers on August 16.
55
30
30
30
Multiple crypto companies warn customers of phishing emails after alleged provider breach
Attackers compromised 120 Brevo email accounts and sent convincing phishing emails to Trezor, BitBox, and CoinTracking newsletter subscribers.
Trezor, BitBox, and CoinTracking confirmed that phishing emails were sent to newsletter subscribers after a compromise of their shared email provider, which CoinTracking identified as Brevo. Brevo said an attacker accessed 120 customer accounts and used them to send phishing emails from legitimate company domains, including fake security alerts like 'Critical Security Alert: STM32 Entropy Vulnerability' and 'Data Breach Notice: Please refresh API Keys.' Trezor had already suffered a separate breach exposing details of 81,000 customers, and CertiK reports physical wrench attacks on crypto holders rose 33 percent year-over-year with $124 million in losses in 2026.
55
Trezor data breach impact now reaches 81,000 customers
Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.
Trezor expanded its August 13 breach disclosure, saying the incident at shipping partner ShipMonk now affects 81,000 customers, with 67,000 additional US customers who ordered between November 2019 and August 2021 exposed. Attackers exploited a Metabase SQL injection zero-day to access ShipMonk's systems, exposing names, emails, phone numbers, shipping addresses, and order numbers; ShipMonk reportedly received extortion emails from the ShinyHunters gang. Trezor's own systems and devices were not compromised, and affected users are warned of phishing and scams. The broader Metabase campaign also hit Tally and Framework.
70
JSCeal Hides Crypto Malware in V8 Bytecode
Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.
JSCeal, tracked by Check Point Research since early 2025, is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime. Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a pipeline that recovered readable code from 23 samples, revealing theft of browser credentials and cookies, Telegram sessions, keystrokes, screenshots, HTTPS traffic interception with attacker-controlled certificates, and automated Google account takeover. Targeted overrides rewrite content for Binance, Bybit, and Ledger users. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS.
58
30
30
30
30
30
50
30
30