SafePal Discloses Data Breach Impacting 39,798 Customers

SafePal, the Binance-backed maker of hardware and software crypto wallets, has disclosed a data breach affecting approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The exposed records include order information such as names, physical addresses, and contact details. While this type of leak may seem less severe compared to larger breaches, it raises significant concerns for the affected customers.

SafePal has assured users that no cryptocurrency funds were compromised during the breach. Passwords, private keys, seed phrases, bank details, payment card numbers, and government-issued IDs remained secure. This assurance is crucial for a company that emphasizes the security of its products.

The breach was caused by an authorization flaw in a third-party plugin used for order tracking, which allowed attackers to access other customers' order details by manipulating order numbers. SafePal has since patched the vulnerability and has reached out to affected users via email.

In response to the breach, SafePal has taken several measures, including hiring an independent third-party auditor, reducing its data retention period to 90 days, and identifying and removing over 30 fraudulent websites and phishing links. Additionally, the company has provided customers with a tool to check if their details were involved in the leak.

Despite the swift response, the breach poses risks beyond the immediate loss of data. The leaked information could facilitate targeted phishing attacks, as attackers can use the details to craft convincing emails that exploit the customers' trust. Furthermore, the exposure of names and addresses raises concerns about physical security, particularly for individuals known to hold cryptocurrency, as it could lead to coercive tactics to obtain their digital assets.

This incident highlights the vulnerabilities associated with third-party plugins, which can serve as weak links in an otherwise secure system. SafePal's experience serves as a reminder that privacy is a critical aspect of security, especially for customers whose personal information is now publicly accessible. While the company deserves credit for its prompt and transparent response, the implications of the breach underscore the importance of robust security measures in the crypto space.