SafePal data breach exposes details of nearly 40,000 users

SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. 

The affected records covered orders placed between March 2, 2025, and April 11, 2026, and included names, email addresses, shipping addresses, phone numbers and purchase details. SafePal said it emailed affected customers individually on Sunday and launched a tool allowing buyers to check orders using their order number and shipping country.

The wallet provider said seed phrases, private keys, wallet passwords, payment card numbers, bank account information and government-issued identification numbers were not exposed. SafePal also said it found no evidence that the incident itself compromised wallet access or customer funds.

SafePal traced the exposure to an order-tracking flaw

SafePal said the issue involved an authorization defect in a plugin used to track orders. Under certain conditions, the flaw allowed unauthorized access to another customer’s order information. The company said it fixed the vulnerability and introduced additional access controls after identifying it.

The company’s incident FAQ provides a longer timeline. SafePal said it first received a phishing report consistent with the problem in early May. It initially treated the report as an isolated case before escalating it into a formal security investigation. In July, the company began a full review and rebuild of its order-processing pipeline and confirmed the plugin flaw during that investigation.

Data-retention failure widened the affected period

SafePal separately disclosed that a scheduled data-cleanup process stopped working correctly between September 2025 and April 2026 because of a configuration error. According to the company, that failure did not cause the unauthorized access but left older order records stored longer than intended, helping extend the affected range back to March 2025.

SafePal has now reduced personal-data retention in the relevant order-processing environment to 90 days, subject to legal requirements. It said affected customers’ personal information has been removed from active e-commerce servers, while an encrypted offline copy is being retained to support potential investigations.

Phishing is now the main risk for customers

The exposed information could help attackers create more convincing phishing attempts using genuine names, addresses and purchase details. SafePal said it has already identified and taken down more than 30 fraudulent websites and phishing links tied to scam activity and continues monitoring for new domains.

The risk resembles other recent wallet-industry incidents. As crypto.news reported, a third-party shipping breach exposed personal information belonging to 13,689 Trezor customers, including names, emails, phone numbers and shipping addresses. In related coverage, scammers have also mailed fake Trezor and Ledger letters containing QR codes designed to steal recovery phrases.

SafePal stressed that it never asks customers for seed phrases, private keys or passwords. It said users do not need to move assets solely because their order information was exposed. However, anyone who has already entered a seed phrase or private key into a suspicious website should “treat that wallet as compromised,” create a new wallet and transfer remaining assets.

What happens next

SafePal said it is engaging an independent third-party security firm to validate its fix and conduct a broader review of its order-processing systems. The firm has not yet been named publicly. SafePal also contacted logistics and fulfillment partners and said it has found no evidence so far that the incident extended into their systems.

The company has opened a dedicated support channel and says it is contacting on-chain asset-tracing specialists for customers reporting financial losses. SafePal cautioned that this “does not represent any admission of liability or commitment to compensation.” It has not identified the unauthorized party or disclosed a confirmed amount lost through follow-on phishing. Further findings are expected through its official security updates.