SafePal Reports Data Breach Impacting 39,798 Customers
SafePal has disclosed a data breach that has impacted around 39,798 customers following the exploitation of a vulnerability in its order-tracking plugin. The flaw allowed unauthorized access to customer order information linked to orders placed between March 2, 2025, and April 11, 2026. This information includes names, email addresses, shipping addresses, phone numbers, and purchase details.
In a notice published by the company, it stated, "Recently, the team identified an authorization flaw in the order-tracking function for a plug-in associated with customer order information. Under certain conditions, the flaw allowed unauthorized access to another customer’s order information." SafePal expressed regret over the incident, confirming that the exposed data pertains to approximately 39,798 customers.
SafePal, based in Singapore, specializes in cryptocurrency security, offering hardware and software wallets for secure digital asset management. The company’s products include hardware wallets, a mobile app, and browser-based tools that support multiple blockchains and cryptocurrencies.
The breach was brought to light as a threat actor began advertising the stolen data on a cybercrime forum, claiming the same number of affected customers. SafePal confirmed the security breach and alerted users about the exposure of their personal and order-related information.
All affected customers were notified individually via email on August 16 and were advised to check their status. The exposed order data could facilitate more convincing phishing attempts, including fraudulent support calls, emails, refund offers, and malicious websites designed to extract additional information.
SafePal reassured customers that sensitive information such as seed phrases, private keys, and wallet passwords were not compromised, and therefore, customers do not need to move their assets solely due to this breach. However, anyone who has shared their seed phrase or private key with an attacker should consider their wallet compromised and create a new one using a trusted device or official app, transferring any remaining funds immediately.
The company emphasized that the breach did not expose seed phrases, private keys, wallet passwords, or other wallet credentials. Additionally, bank details, payment card numbers, and government IDs were not involved, as SafePal does not collect or store such information. There was no evidence that the incident compromised access to customer wallets or funds.
SafePal stated, "However, if you have already shared or entered your seed phrase or private key in response to a suspicious message, website, phone call, or letter, treat that wallet as compromised." Customers are encouraged to create a new wallet using a trusted SafePal device or application and to move their remaining assets to the new wallet promptly.
The company has addressed the vulnerability and implemented additional security measures, with an independent security firm reviewing the fix and order-processing systems. SafePal has also reduced data retention to 90 days, contacted affected customers and logistics partners, and opened a dedicated support channel.
In response to the breach, SafePal identified and removed over 30 fraudulent websites and phishing links. The company will continue to monitor scams, investigate potential risks, and provide updates through its official channels.
Customers who have suffered financial losses related to the breach are encouraged to contact SafePal, which is collaborating with specialists to trace stolen on-chain assets. SafePal will maintain a dedicated webpage for FAQs and updates regarding this incident.
