SafePal Data Breach Exposes Order Information of Nearly 40,000 Customers

Crypto hardware wallet provider SafePal has disclosed a security incident affecting nearly 40,000 customers, exposing personal data linked to hardware wallet orders.

According to SafePal, an authorization flaw in an order-tracking system let outsiders see data belonging to other customers. About 39,798 customers who placed orders between March 2, 2025 and April 11, 2026 were affected.

The good news is that the breach did not expose private keys, seed phrases, wallet passwords or crypto funds. However, the personal data that was exposed could make affected customers attractive targets for very convincing phishing and fake-support scams.

What Happened?

SafePal said it discovered an access flaw in the order-tracking part of a plug-in used for customer orders.

Under certain conditions, the flaw let someone using the system see another customer's order details.

The exposed data included:

• Customer names
• Email addresses
• Phone numbers
• Shipping addresses
• Purchase and order details

SafePal says the flaw affected around 39,798 customers whose orders were placed during the affected period. The company patched the issue after finding it and added extra security measures.

This was therefore not a compromise of SafePal's hardware wallets themselves. Instead, the incident hit the systems around the sale and shipping of those devices.

That distinction is important, but it doesn't make the incident harmless.

Private Keys and Crypto Funds Were Not Exposed

SafePal says it found no evidence that the incident provided attackers with access to users' wallets or crypto.

The company stated that the exposed systems did not contain:

• Seed phrases
• Private keys
• Wallet passwords
• Bank account details
• Payment card numbers
• Government ID numbers

SafePal says it does not request or store wallet credentials such as private keys and recovery phrases as part of its customer order systems.

For users who only had their order details exposed, SafePal says there is no reason to move crypto to another wallet just because of this breach.

However, there is an important exception.

Anyone who has already entered or shared a seed phrase or private key after receiving a suspicious email, phone call, website link or other message should treat that wallet as unsafe and move what is left to a brand-new wallet.

Why This Data Can Still Be Dangerous

At first glance, leaked names and shipping details may seem less serious than stolen private keys.

For crypto users, however, this type of data can be very sensitive.

An attacker may now know that a person:

1. Bought a crypto hardware wallet.
2. Uses or has an interest in crypto.
3. May hold crypto themselves.
4. Can be contacted through email or phone.
5. May have had a hardware wallet sent to a specific home address.

That opens the door to very targeted scams.

Instead of sending a generic phishing email claiming that a wallet needs to be updated, a scammer could mention the victim's real name, phone number, address or SafePal purchase.

A message with accurate personal details is much more convincing.

SafePal warned customers that the exposed data could be used for fake phone calls, emails, text messages, letters, refund offers, firmware updates, support chats and harmful websites built to steal wallet logins.

Phishing Is Now the Biggest Risk

The biggest threat right now likely isn't someone hacking a SafePal device from afar.

It's social engineering: tricking people.

Imagine receiving an email that includes your real name and details about a SafePal order:

"We detected a security issue affecting your SafePal hardware wallet. Please verify your device using the recovery tool below."

A user who knows about the breach might assume the message is real.

The fake website could then ask for the user's 12- or 24-word recovery phrase.

Once a seed phrase is typed into a website an attacker runs, the attacker doesn't need the hardware wallet. The recovery phrase alone can give control over the linked crypto.

SafePal says it has already identified and taken down more than 30 fake websites and phishing links tied to scams around the incident.

That suggests affected users should be extra wary of surprise messages about their wallets or past orders.

SafePal Notified Affected Customers

SafePal disclosed the incident publicly on August 16, 2026.

According to the company, affected customers were also contacted directly by an email from security@safepal.com with the subject:

"[Important] Your SafePal Order Information Has Been Affected."

SafePal has also set up a lookup tool where customers can check whether their order was affected, using their order ID and shipping country.

Users should still avoid clicking links in surprise messages that claim to be about the breach. Typing SafePal's web address yourself is safer.

SafePal Changes Its Data Retention Policy

SafePal says it has made several changes since the incident.

The company has:

• Fixed the access flaw.
• Added extra security measures.
• Begun hiring an outside security firm to review the fix and its wider order systems.
• Opened a dedicated support channel for affected customers.
• Contacted shipping partners to check whether the issue spread beyond SafePal's systems.
• Taken down more than 30 fake websites and phishing links.

Perhaps the biggest change is SafePal's new approach to customer data.

The company says personal data stored in the affected order system will now usually be kept for only 90 days, unless the law requires longer.

For a company selling products built around crypto security, keeping less customer data on hand could greatly cut the damage from future incidents.

Hardware Wallet Privacy Is More Than Private-Key Security

The SafePal incident highlights an often missed part of crypto security.

A hardware wallet can protect private keys very well while a wholly separate system exposes data about who owns that hardware wallet.

These are two different security problems.

A hardware wallet mainly protects the keys that control crypto.

An online store, on the other hand, may need to process:

• Names
• Addresses
• Contact details
• Payments
• Shipping details
• Order history

Breaking into the second system does not mean the first is broken too.

But linking someone's real name and home address to the purchase of a crypto security device creates its own privacy problem.

For crypto users, metadata can be valuable to an attacker even when no private keys are exposed.

What Affected SafePal Customers Should Do

Customers who purchased SafePal products during the affected period should be more careful than usual about surprise messages.

Most importantly:

Never provide your seed phrase or private key to anyone.

SafePal says its staff will never ask for this through email, phone or any other channel.

Users should also:

• Avoid clicking links or scanning QR codes in SafePal messages you didn't ask for.
• Go straight to SafePal's official website instead of following email links.
• Ignore requests to "verify" a wallet using a recovery phrase.
• Be wary of surprise replacement devices or hardware deliveries.
• Check firmware updates through official channels.
• Treat surprise phone calls claiming to be SafePal support as suspect.
• Never enter a recovery phrase into a website because of an email, text or phone call.

If a seed phrase has already been exposed, simply changing a password isn't enough. The funds should be moved to a brand-new wallet made from a new seed phrase.

Privacy Remains a Critical Part of Crypto Security

The SafePal breach is another reminder that crypto security doesn't stop at protecting private keys.

Knowing who owns crypto, what hardware they use and where they live can itself be valuable.

Hardware wallets remain one of the strongest methods of protecting private keys from online attacks, and SafePal says the security of its wallets' keys was not broken in this incident.

But companies in the crypto industry also carry a special duty when they collect customer data.

A leaked email address is annoying.

A leaked email address combined with a name, phone number, physical address and proof that the person bought a crypto hardware wallet is far more sensitive.

For affected SafePal customers, the most important thing now is simple: assume future messages about your wallet may be aimed at you, check everything yourself, and never reveal your seed phrase.