SafePal Data Breach Exposes 40,000 Customers' Information

Cryptocurrency hardware wallet provider SafePal has disclosed a data breach affecting approximately 39,798 customers, exposing personal and order information after an authorization flaw was exploited. The company announced the incident on August 16, 2026, warning that a threat actor is now attempting to sell the stolen data on a cybercrime forum.

The breach impacts customers who placed orders between March 2, 2025, and April 11, 2026. Exposed information includes names, email addresses, shipping addresses, phone numbers, and purchase details. SafePal emphasized that the incident did not compromise wallet seed phrases, private keys, passwords, payment card numbers, bank account information, or government-issued identification numbers. The company stated there is no evidence that the breach itself compromised access to SafePal wallets or customer funds.

SafePal traced the exposure to an authorization defect in a plugin used for order tracking. Under certain conditions, this flaw allowed unauthorized access to another customer's order information. The vulnerability was identified and fixed in July 2026 during a full review and rebuild of the company's order-processing pipeline....