SafePal Data Breach Exposes Personal Information of Nearly 40,000 Customers

SafePal, a maker of bitcoin and crypto wallets, announced on Saturday that a flaw in an order-tracking plug-in allowed attackers to access the personal information of around 39,798 customers. This incident raises concerns about the potential for physical attacks on users of hardware wallets. According to a statement from SafePal, the exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details for customers who placed orders between March 2, 2025, and April 11, 2026.

The company emphasized that wallet credentials were not compromised, meaning that seed phrases, private keys, wallet passwords, bank details, payment card numbers, and government IDs were not involved in the breach. SafePal, which is backed by Binance and Animoca Brands and claims to serve 30 million users, has since rectified the issue, notified affected customers via email, and established a webpage for individuals to check if their information was exposed.

While no funds were stolen, the combination of names, home addresses, and evidence of cryptocurrency ownership poses a risk, as it could attract criminals targeting high-net-worth individuals. This concern is heightened by a rise in violent incidents known as wrench attacks, where victims are threatened or assaulted for their crypto assets. Chainalysis reported 46 such incidents in the first half of 2026, resulting in over $30 million in stolen assets, indicating a troubling trend where home invasions are increasingly replacing kidnappings.

SafePal is not alone in facing such challenges; it joins a growing list of wallet companies that have experienced data breaches. Just days prior, Trezor, another hardware wallet manufacturer, revealed that a breach at its shipping partner, ShipMonk, compromised data for approximately 13,700 customers. The most notable cautionary tale remains Ledger, which suffered a significant leak in 2020 affecting 272,000 customers, leading to a surge in phishing attempts and ransom threats.

The timing of this breach adds to the anxiety among self-custody users, who are still reeling from the Coldcard exploit that drained dormant Bitcoin due to a firmware flaw, contributing to industry-wide losses nearing $130 million. SafePal has apologized to its community and committed to providing updates on its blog as the investigation progresses.