SafePal Confirms Data Breach Affecting Nearly 40,000 Customers

Crypto hardware wallet company SafePal has confirmed a security incident that exposed personal information belonging to thousands of its customers. The exposed data included names, home addresses, and contact details, which puts affected users at higher risk of phishing attempts and impersonation scams going forward. Importantly, the company says no cryptocurrency funds, passwords, or private wallet keys were compromised in the breach.

SafePal is known for making physical hardware wallets and companion apps that help crypto investors store and manage their digital assets more securely. The breach impacted 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.

What Actually Went Wrong

According to SafePal, the issue stemmed from an authorization flaw found in a plug-in used to track customer orders. This flaw made it possible for one customer to potentially view another customer’s order details simply by altering an order number, similar to a delivery tracking system accidentally letting strangers peek at each other’s receipts.

The company was quick to clarify that its core wallet security remains fully intact. Seed phrases, private keys, banking passwords, payment card numbers, and government issued IDs were not part of the exposed data. However, SafePal warned that any user who previously shared their private keys or seed phrase through a phishing email, phone call, or letter should assume their wallet has been compromised and move their funds to a new one immediately.

Part of a Bigger Pattern in Hardware Wallet Security

This incident comes shortly after a separate hack involving Coldcard hardware wallets, where attackers reportedly stole more than 120 million dollars worth of bitcoin. While these two incidents don’t necessarily point to a widespread flaw across all hardware wallets, they do serve as a reminder that no storage method is completely risk free. Many in the industry are again pointing to the importance of spreading out crypto holdings across multiple wallets rather than relying on a single point of storage.

How SafePal Is Responding

SafePal said it has already patched the vulnerability and rolled out additional security protections. The company notified all affected customers directly by email on Sunday and brought in an independent security firm to audit the fix and review its broader order processing systems.

Going forward, SafePal says it will only retain customer personal data within its order system for 90 days from the date it was originally collected. The company also confirmed it identified and took down more than 30 fraudulent websites and phishing links tied to the breach. Customers concerned about whether their information was affected can use a verification tool available on SafePal’s official website to check their status.