SafePal Confirms Order Data Breach Impacting 40,000 Customers, Wallet Credentials And Funds Remain Uncompromised
In Brief
SafePal disclosed a data breach affecting 40,000 customers. Order details were exposed, but wallet credentials and funds remain secure. Flaw fixed.
SafePal, a prominent provider of cryptocurrency hardware and software wallet solutions, has disclosed a security incident involving an authorization flaw in an order-tracking plugin. The vulnerability, which existed within a plugin associated with customer order information, allowed unauthorized external access to order records under certain conditions, affecting approximately 39,798 individuals who placed orders between March 2, 2025 and April 11, 2026.
According to the company’s disclosure, the compromised data includes names, email addresses, shipping addresses, phone numbers, and purchase details. SafePal emphasized that more sensitive categories of information were not involved in the breach, specifically noting that seed phrases, private keys, wallet passwords, payment card numbers, bank account details, and government-issued identification numbers remained secure.
The company further stated that no evidence indicates the incident compromised access to SafePal wallets or customer funds. All affected individuals were notified individually via email on August 16 from the address [email protected] with the subject line indicating order information had been affected, and the company has published a dedicated verification page where customers can confirm their status using an order identification number and shipping country.
Company Response and Recommended Precautions
Following the discovery, SafePal remediated the authorization flaw and introduced supplementary security measures. An independent third-party security firm has been engaged to validate the fix and perform a comprehensive review of the broader order-processing infrastructure. The company has also contacted relevant logistics and fulfillment partners to confirm the issue had not spread further within their systems.
Additionally, the retention period for personal information within the affected environment has been tightened to 90 days, subject to applicable legal requirements, and a dedicated support channel has been established to ensure affected customers receive direct, tracked assistance. Progress on these ongoing measures will be disclosed through official company channels.
SafePal has also identified and removed more than 30 fraudulent websites and phishing links tied to scam activities, with continued monitoring for emerging threats. The company cautioned that exposed order details could be exploited in targeted social engineering campaigns, including fraudulent refund offers, fake firmware-update requests, and impersonation of customer support through phone calls, emails, text messages, physical mail, or unexpected hardware deliveries referencing a SafePal purchase.
Customers are advised to exercise caution with unsolicited communications, refrain from clicking links or scanning QR codes in unexpected messages, and manually enter the official website address rather than following redirects. SafePal reiterated that it never requests seed phrases, private keys, or passwords through any communication channel under any circumstance.
Users who may have disclosed wallet credentials in response to suspicious outreach should treat the affected wallet as compromised, create a new wallet using an official SafePal device or application, transfer assets immediately, and contact the company through its official support channel.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
