SafePal discloses breach impacting 40,000 users’ data

The Breach by the Numbers

SafePal confirmed on Sunday that the breach affected 39,798 customers. Exposed data included names, addresses, and purchase specifics tied to individual orders.

The unauthorized access occurred between March 2, 2025, and April 11, 2026. An authorization flaw in SafePal’s order tracking system was identified as the root cause, allowing access to other customers’ order data that should have stayed private.

What Stayed Protected

SafePal offers hardware, mobile, and browser wallets for storing and managing digital assets. Despite the breach’s scope, the company says the core elements that actually protect funds were never touched.

• Seed phrases
• Private keys
• Wallet passwords
• Bank details
• Government-issued identification numbers

These credentials are known only to the user, and losing them cuts off access to funds entirely. The breach stayed contained to order data, which is sensitive but not the kind of information that puts crypto holdings directly at risk.

The Real Risk Is Phishing

Exposed order information still creates real danger, just a different kind. Affected users could face targeted phishing attempts or impersonation scams built around their actual purchase history and personal details, according to the company.

Scammers with access to real names, addresses, and order specifics can build far more convincing attacks than generic phishing attempts. Knowing someone bought a specific hardware wallet model on a specific date makes a fake support email or fraudulent link much harder to spot.

How SafePal Responded

SafePal says it has fixed the authorization flaw and rolled out additional security measures. The company now retains customer personal data in its order processing system for only 90 days, a policy shift meant to limit how much exposure any future breach could cause.

SafePal also moved against the fallout directly. The company identified and took down more than 30 fraudulent websites and phishing links tied to the breach.

Staying Safe After a Breach Like This

Even with SafePal’s response, affected users remain more exposed than before. The leaked data makes targeted attacks more likely, not less, which means vigilance matters more now than usual.

• Verify sender identity before responding to any SafePal-related communication
• Check URL authenticity carefully before clicking links, especially in unsolicited emails
• Treat unexpected support requests or account alerts with extra suspicion

This incident is a reminder that crypto security threats extend well beyond wallet credentials. Personal data alone, even without touching seed phrases or private keys, can be weaponized for social engineering. Users need to stay alert across every touchpoint a company holds, not just the ones tied directly to their funds.