SafePal breach exposes customer details to phishing risk

SafePal has warned nearly 40,000 customers that their personal information was exposed after attackers exploited a flaw in an order-tracking system, creating a heightened risk of targeted phishing and impersonation attacks against cryptocurrency holders.

The cryptocurrency wallet provider said information belonging to approximately 39,798 customers was accessed without authorisation. The affected records covered purchases made between March 2, 2025 and April 11, 2026 and contained names, email addresses, shipping addresses, telephone numbers and purchase details.

Seed phrases, private keys, wallet passwords and other credentials used to control cryptocurrency were not exposed. Bank account information, payment-card numbers and government-issued identification documents were also outside the compromised dataset, and there is no evidence that access to SafePal wallets or customer funds was obtained directly through the breach.

The disclosure shifts the immediate security concern from direct compromise of the hardware wallet to social engineering. Attackers possessing genuine customer names, addresses and details of SafePal purchases can construct highly personalised emails, telephone calls, text messages and letters designed to persuade users to surrender credentials.

Customers could, for example, receive convincing messages claiming that their hardware wallet requires an urgent firmware update, that their device must be returned or that their holdings need to be transferred to another wallet. SafePal has also warned about bogus refund offers, fake customer-support communications and malicious websites designed to capture sensitive information.

SafePal traced the exposure to an authorisation weakness in a plug-in associated with its order-tracking function. Under particular conditions, the vulnerability permitted unauthorised access to another customer’s order information. The company patched the flaw after identifying it and added further security controls.

Signs of the problem had appeared months before the public disclosure. SafePal received a report consistent with the issue in early May and initially treated it as an isolated case. The matter was subsequently escalated into a formal security investigation. A wider examination and rebuild of the order-processing environment began in July, during which the authorisation vulnerability was identified.

Investigators also found that a separate configuration problem had disrupted a data-cleaning process between September 2025 and April 2026. That failure meant order records dating as far back as March 2025 had remained available within the affected environment for longer than intended. Personal information linked to affected orders has since been removed from active e-commerce servers, while an encrypted offline copy is being retained for possible law-enforcement requirements.

All identified affected customers were sent individual notifications on August 16. SafePal has also provided an online mechanism allowing buyers to determine whether an order was affected by entering their order number and shipping country.

The company has shortened the retention period for personal information within the relevant order-processing environment to 90 days, subject to legal requirements. An independent security company is being engaged to validate the remediation work and carry out a broader examination of the systems handling customer orders. Third-party logistics and fulfilment companies have also been contacted as part of the investigation.

More than 30 fraudulent websites and phishing links connected with scam activity have already been identified and taken down, illustrating how quickly customer information from a cryptocurrency business can be weaponised even when private keys themselves remain protected. Monitoring for additional domains and impersonation campaigns is continuing.

A threat actor has meanwhile claimed on a cybercrime forum to be offering the SafePal customer information for sale. The advertisement referenced the same approximate number of customers and affected order period disclosed by SafePal, although possession and authenticity of the dataset have not been independently established.

The episode follows heightened scrutiny of security surrounding hardware-wallet users. Trezor disclosed this month that personal details connected with nearly 14,000 customers had been exposed following a breach involving a fulfilment provider, underscoring the vulnerability of customer information surrounding devices designed to keep cryptocurrency credentials offline.

The distinction is important because hardware wallets isolate private keys from internet-connected systems, but purchasing and delivering those products still generates conventional e-commerce records. Research into earlier cryptocurrency-wallet data breaches has found that exposed customers can subsequently face spam, phishing, scams and other forms of targeting even where the underlying security device remains uncompromised.