30
SafePal latest crypto hardware wallet maker affected by breach, with nearly 40,000 impacted
SafePal confirmed nearly 40,000 customers' order data was stolen, the third hardware wallet maker breached in a month after Trezor and Coinkite.
SafePal confirmed a breach exposing names, emails, shipping addresses, phone numbers, and purchase details of customers who ordered between March 2, 2025 and April 11, 2026, caused by a flaw in an order-tracking plugin. The company stressed wallets, seed phrases, and private keys remain secure, and all impacted customers were notified by email. A hacker advertised the stolen data on a dark web forum, and SafePal warned of targeted phishing via fake support calls and refund offers. CertiK data cited in the report shows 52 wrench attacks worldwide in H1 2026 with $124 million in losses, up 33% year-over-year.
55
42
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
SafePal disclosed an order-tracking plug-in authorization flaw exposing names, emails, addresses and purchase details of 39,798 hardware wallet customers; no wallet credentials affected.
Hardware wallet maker SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed names, email addresses, shipping addresses, phone numbers and purchase details of approximately 39,798 customers. No seed phrases, private keys, wallet credentials or financial information were exposed, and SafePal found no evidence of wallet or fund compromise. A separate configuration error left a data-cleanup process broken between September 2025 and April 2026, extending the affected order window back to March 2025. A threat actor has advertised a matching dataset on a cybercrime forum, and the company has fixed the flaw, cut data retention to 90 days, purged affected records, engaged third-party validators and taken down over 30 phishing sites.
48
55
57
30
45
30
30
30
30
45
42
57
30
45
SafePal Data Breach Hits Tens of Thousands of Customers
A data breach at crypto hardware wallet maker SafePal has impacted the personal data of nearly 40,000 customers.
Infosecurity Magazine reports that a data breach at SafePal, a provider of cryptocurrency hardware wallets, has affected nearly 40,000 customers. The incident impacted tens of thousands of users of the wallet provider, though details on the attack vector and exact data types exposed were not provided in the source text. Customers of hardware wallet vendors are attractive targets given their association with cryptocurrency holdings.
50
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.
Trezor disclosed that a breach at shipping provider ShipMonk exposed names, email addresses, phone numbers, shipping addresses, and order numbers of 67,000 additional US customers, with orders dating November 2019 to August 2021 despite written assurances the data had been deleted. This adds to the 13,689 customers previously disclosed after ShipMonk informed Trezor of unauthorized access on August 10, 2026. According to Holborn, the ShinyHunters extortion gang is behind the breach, which began with zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metaboobase analytics software Metabase. Trezor says hardware wallet security is unaffected but warns customers to watch for phishing and social engineering; ShipMonk has not publicly acknowledged the incident.
72
30
57
42
42
57
60
30
30
30
47
30
42
57
42
35
SafePal Says 39,798 Customers Hit by Data Breach
Crypto wallet maker SafePal disclosed a breach exposing order data of 39,798 customers via a plugin authorization flaw; keys and seed phrases unaffected.
SafePal, a Singapore-based cryptocurrency security company, said an authorization flaw in an order-tracking plugin let attackers access order records placed between March 2, 2025 and April 11, 2026. Exposed data includes names, emails, addresses, phone numbers, and purchase details for about 39,798 customers, while seed phrases, private keys, wallet passwords, and payment data were not exposed. A threat actor advertised the same dataset on a cybercrime forum, and affected customers were notified by email on August 16. The company patched the flaw, reduced data retention to 90 days, and removed over 30 fraudulent phishing websites.
55
57
60
30
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.
25
Trezor customers hit with phishing calls and letters after shipping-partner breach
A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.
SatoshiLabs, maker of Trezor hardware wallets, confirmed the August 2026 ShipMonk breach exposed names, emails, phone numbers, and shipping addresses for roughly 67,000 US customers who ordered between November 2019 and August 2021, on top of 3,889 customers affected initially. ShipMonk attributed the intrusion to attackers exploiting an SQLi zero-day in Metabase's Cloud SaaS platform and retained data past the 90-day deletion requirement. Trezor's own systems were not compromised; customers are reporting phishing calls and QR-code phishing delivered via physical letters.
50