SafePal Data Breach: Nearly 40,000 Customers Affected

SafePal, the company behind hardware wallets for cryptocurrencies, has warned customers of a data breach affecting roughly 39,798 people. An attacker exploited a vulnerability to steal order information and is now offering that data for sale.

According to SafePal, the breach affected anyone who placed orders between March 2, 2025 and April 11, 2026. Names, email addresses, shipping addresses, phone numbers and purchase details fell into the attacker's hands. The company stresses, however, that seed phrases, private keys, passwords, banking details, payment card numbers and identity documents were not affected. No evidence was found that the wallets themselves or any funds had been compromised.

All of those affected were notified by email on August 16, in a message with the subject line “[Important] Your SafePal Order Information Has Been Affected.” The company also launched an online checking tool: by entering an order number and shipping country, customers can find out whether their data was part of the breach.

How It Happened

SafePal received its first warning sign back in early May 2026, but initially treated the case as an isolated incident. Even then, customers were complaining about phishing emails and phone calls from people posing as staff: one email claimed that a vulnerability had been found in the SafePal X1 wallet and that the firmware needed to be updated urgently.

In July the company undertook a “full review and rebuild” of its order-processing system and discovered an authorization flaw in the order-tracking feature of one of its plugins — it allowed access to other people's orders. The vulnerability was patched, but during the investigation it emerged that the attacker had already managed to siphon off the data of nearly 40,000 customers.

Another oversight surfaced separately: because of a configuration error, the data-cleanup mechanism stopped working between September 2025 and April 2026. As a result, orders dating all the way back to March 2025 were still stored in the system — far longer than they should have been.

The Data Is Already for Sale

A seller has appeared on a cybercrime forum referencing the same order period and the same number of victims. As proof of authenticity, they are willing to provide order IDs and shipping countries, which buyers can verify through that very same SafePal checking tool. “Not interested in low bids — come with a decent price or don't bother writing,” the listing states. BleepingComputer was unable to independently confirm that the seller actually possesses the stolen data.

SafePal says it has removed the personal data from its active servers, keeping an encrypted offline copy in case of an investigation, and has already taken down more than 30 fraudulent sites and phishing links. Customers are advised to be wary of emails and calls about “urgent firmware updates,” refunds and legal proceedings. There is no need to replace a wallet or move funds — unless the user has already handed a seed phrase or private key to scammers. In that case, the wallet should be considered compromised and the assets moved to a new device.

Source: Bleeping Computer