SafePal has announced that a vulnerability in an order-tracking plugin exposed the personal information of approximately 39,798 customers. The exposed data included customer names, email addresses, phone numbers, shipping addresses, and purchase information.
According to the cryptocurrency hardware wallet manufacturer, affected individuals were notified via email on August 16 through its official security address,
The company emphasized that the incident did not expose any wallet-related credentials or financial information. SafePal stated that there is no evidence suggesting the breach provided attackers with access to customers' wallets, digital assets, or funds.
In its notification, SafePal clarified that sensitive information such as seed phrases, private keys, wallet passwords, banking details, payment card data, and government-issued identification numbers were not involved in the incident.
The vulnerability reportedly allowed unauthorized individuals to access another customer's order details under specific circumstances. However, SafePal has not disclosed the name of the affected plugin, its vendor, or the software version involved. The security issue has also not been assigned a CVE identifier.
The impacted orders were placed between March 2, 2025, and April 11, 2026. SafePal noted that these dates represent the order period rather than the timeframe during which the vulnerability was actively exploitable. The company has not revealed when the unauthorized access began or ended, how many unauthorized parties accessed the data, or how the issue was initially discovered.
Because the exposed records connect customers' identities with home addresses and purchase histories, SafePal warned users to remain alert for phishing and social engineering attacks. Potential threats include fraudulent phone calls, emails, text messages, letters, fake refund offers, fraudulent firmware update requests, and impersonation attempts by individuals posing as SafePal support personnel.
The company stressed that the exposed information did not include wallet addresses, account balances, or details related to customers' cryptocurrency holdings. Customers were advised to treat any unexpected communication or hardware shipment referencing a SafePal purchase as suspicious, regardless of whether it arrives by phone, mail, or in person.
The disclosure comes amid growing concerns over physical and online threats targeting cryptocurrency holders. Blockchain intelligence firm Chainalysis reported 46 documented violent incidents involving crypto-related victims worldwide through late June, resulting in more than $30 million in stolen assets. The firm noted that criminals increasingly view cryptocurrency owners as attractive targets because digital assets can be transferred quickly and irreversibly.
Separately, SafePal identified an issue with its data-retention processes. Between September 2025 and April 2026, a configuration error prevented a scheduled data-cleanup mechanism from functioning properly, causing customer order records to remain stored longer than intended.
The company stated that while this retention issue did not directly contribute to the unauthorized access, it expanded the number of historical records affected by the incident, extending the exposure window back to March 2025.
The announcement follows a separate disclosure from hardware wallet manufacturer Trezor, which recently reported a breach involving logistics provider ShipMonk. Trezor indicated that a pre-existing 90-day data retention policy helped reduce the extent of its exposure.
SafePal said it first received a report consistent with the issue in early May 2026. Initially treated as an isolated incident, the report was later escalated into a formal security investigation, prompting the company to implement additional safeguards.
In its incident FAQ, SafePal addressed questions about why phishing-related complaints submitted in May were not fully explained until August. One customer reportedly posted on X that they had received a suspicious email, letter, and phone call from someone claiming to represent SafePal. While the timing raised concerns, no confirmed link has been established between those phishing attempts and the data exposure.
The company stated that it launched a comprehensive review and overhaul of its order-processing infrastructure in July, during which investigators identified and confirmed the root cause of the problem.
Adding to the concern, a threat actor has reportedly advertised a dataset on a cybercrime marketplace containing information that matches both the affected customer count and the disclosed order period. Cybersecurity monitoring service DarkWebInformer highlighted the listing on August 16. The seller reportedly offered sample order IDs and shipping-country information, enabling prospective buyers to compare the data with SafePal's own verification system.
As of the time of reporting, SafePal had not issued any public statement regarding the alleged dark web listing through its blog, incident portal, or official X account, and the company had not responded to media requests for comment.
Actions Taken by SafePal
SafePal said it has implemented several measures in response to the incident:
- Remediated the identified vulnerability and introduced additional security controls.
- Reduced data retention within affected order-processing systems to 90 days, subject to legal requirements.
- Removed impacted records from active servers while maintaining encrypted offline backups for investigative purposes.
- Engaged an independent security firm to validate the remediation and assess overall order-processing security.
- Contacted logistics and fulfillment partners to verify that their systems were not affected.
- Removed more than 30 phishing websites and fraudulent links associated with related scam activity.
- Launched a customer verification portal that allows users to check their status using an order ID and shipping country, along with a dedicated support channel.
SafePal stated that customers generally do not need to move their cryptocurrency assets solely because of the exposure. However, anyone who disclosed a seed phrase or private key after responding to suspicious communications should immediately consider their wallet compromised and take appropriate action.
The incident has drawn comparisons to Ledger's 2020 data breach, which exposed approximately 272,000 customer records containing names, phone numbers, and mailing addresses. Subsequent research presented at USENIX Security 2023 documented widespread spam, phishing attempts, scams, and reports of possible device tampering among affected users, along with increased concerns for personal safety.
At present, neither SafePal nor major media outlets have reported any confirmed financial losses directly linked to the incident. Nonetheless, SafePal has encouraged affected individuals who believe they suffered losses to contact the company's support team. The firm also stated that it is working with blockchain asset-tracing specialists, although it has not confirmed any cases where losses have been directly attributed to the exposed customer data.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
