SafePal disclosed on August 16, 2026 that a flaw in its order tracking plug-in exposed personal data belonging to roughly 39,798 customers. The exposed information includes names, email addresses, shipping addresses, phone numbers, and purchase details.
What to Know?
- Roughly 39,798 customers who ordered between March 2, 2025 and April 11, 2026 had personal data exposed.
- Exposed details include names, email addresses, shipping addresses, phone numbers, and purchase records, but not seed phrases or private keys.
- SafePal emailed every affected customer individually on August 16 and opened a lookup page using order ID and shipping country.
- SafePal said it has taken down more than 30 fraudulent websites tied to the incident and continues monitoring for new ones.
How It Happened?
SafePal said the flaw sat in the order tracking function of a plug-in tied to customer order information, and under certain conditions it let one customer see another customer’s order details without authorization. The company fixed the issue after discovery and added extra security measures, though it hasn’t said what those measures involve.
SafePal has not disclosed how the flaw was found or how long it was exploitable before the fix, gaps that leave the full timeline of unauthorized access unclear. “No evidence has been found that the incident itself compromised access to SafePal wallets or funds,” the company said in its blog post disclosing the security update.
Dear community,
— SafePal – Crypto Wallet (@SafePal) August 16, 2026
While your SafePal wallet, seed phrase, and private keys are secure; we identified a flaw in the order-tracking plug-in that led to unauthorized access to information of a subset of customers.
The issue has been fixed with additional security measures…
Scope of the Breach
SafePal’s disclosure covers customers who placed orders within that roughly 13-month window. The exposed data did not include seed phrases, private keys, wallet passwords, bank account information, payment card numbers, or government-issued identification numbers, according to the disclosure, and SafePal has not said whether the affected customer count could still shift as its third-party review continues.
SafePal warned that the exposed contact and purchase details could fuel more convincing phishing attempts, including fraudulent phone calls, texts, letters, refund offers, fake firmware update requests, and impersonated customer support outreach. That risk profile lines up with patterns tracked in broader phishing attack trends, where attackers increasingly pair stolen order data with hardware wallet scams.
SafePal’s Response
SafePal took several other steps beyond emailing every affected customer from security@safepal.com under the subject line “[Important] Your SafePal Order Information Has Been Affected.” Those steps included:
- Engaged an independent third-party security firm to validate the fix and review the broader order-processing system.
- Tightened the retention period for personal information in the relevant order-processing environment to 90 days, subject to legal requirements.
- Opened a dedicated Zendesk support channel specifically for this incident.
- Contacted third-party logistics and fulfillment partners to confirm the flaw had not spread into their systems.
This incident originated in SafePal’s order processing layer, a part of the business separate from wallet firmware or private key storage.
What Affected Customers Should Do?
Customers can check their status on SafePal’s scam-protection page using an order ID and shipping country. SafePal recommends never sharing a seed phrase, private key, or password with anyone, including someone claiming to represent SafePal support, and avoiding links or QR codes in unsolicited emails, texts, or letters. The company also flagged a lookalike domain that swaps the letter “l” in its web address for a capital “I,” and it advises typing www.safepal.com directly into a browser instead of following a link from any message.
Anyone who has already entered a seed phrase or private key in response to a suspicious message, call, or letter should treat that wallet as compromised now. That step matters more than checking exposure status alone, because a phished credential is what actually drains a wallet. Suspicious contact should go to SafePal’s scam protection page, the company said, since it prefers that channel over social media for privacy reasons.
Have a tip or story?
If you were affected by the SafePal data breach or have additional information, please contact us.
SQ Magazine’s Takeaway
The breach did not touch wallet credentials. The exposed order history, tied to a name, address, and phone number, still works as effective raw material for impersonation scams aimed at hardware wallet owners. A scammer who knows what a customer bought and when can fake a firmware update or a refund notice with far more credibility than a generic phishing email, which explains why SafePal’s own advisory leans so heavily on verifying contact channels rather than on rotating passwords.
Patch validation is still in progress. SafePal said an independent security firm is auditing the fix and reviewing its wider order processing system, with updates promised on its blog. The company also plans to keep collecting user reports so it can take down new phishing sites beyond the 30-plus already removed. Customers who ordered a SafePal device during that window should expect continued monitoring rather than a single all clear, and should treat any unexpected SafePal branded contact, by phone, mail, or in person, as suspect until verified through the official channel.
