Crypto hardware wallet provider SafePal has disclosed a security breach that exposed the personal information of nearly 40,000 customers, marking the latest in a wave of data leaks striking the hardware wallet industry.
The Binance Labs-backed company confirmed that names, physical addresses, and contact details were compromised through an authorization flaw in one of its order-tracking plug-ins, though it stressed that seed phrases, private keys, and customer funds remain fully secure.
What Happened
According to SafePal’s official disclosure posted on Sunday, the incident stemmed from an “authorization flaw” in a plug-in used to track customer orders. The vulnerability allowed unauthorized parties to view other customers’ order details, functioning much like a parcel-tracking system that lets one customer see another’s receipt and delivery information simply by changing the order number.
The breach affected 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. Exposed data included customer names, physical addresses, and phone numbers, according to disclosures.
The company emphasized that its core wallet security was never touched, confirming that users’ seed phrases, private keys, bank passwords, bank account information, payment card numbers, and government-issued IDs were not compromised. However, SafePal warned that anyone who has already shared their private keys or seed phrases through a phishing email, phone call, or letter should treat their wallet as compromised and immediately move assets to a new wallet.
SafePal’s Response
SafePal said it has patched the vulnerability and rolled out additional security measures. The company notified all affected customers by email from security@safepal.com on Sunday and hired an independent third-party security firm to audit the fix and review its order-processing systems.
The wallet maker also confirmed it has identified and taken down more than 30 fraudulent websites and phishing links tied to the stolen data. Going forward, SafePal said it will retain customer personal data in its order-processing system for only 90 days from the date of collection.
Customers can use a verification tool on SafePal’s website to check whether their data was affected in the incident.
Former Binance CEO Changpeng Zhao weighed in on the disclosure, amplifying the warning to users, while onchain analyst Stacy Muur highlighted the phishing risks tied to the leaked buyer database. The breach lands during an unusually tense stretch for the self-custody community, following recent warnings from CZ that even hardware wallets are not immune to bugs.
A Widening Pattern of Hardware Wallet Data Leaks
SafePal’s disclosure comes just days after Trezor confirmed a separate incident in which its shipping partner ShipMonk was hacked, exposing personal data of roughly 14,000 Trezor customers across seven countries. The two disclosures within a single week have raised fresh alarm about how customer data is handled by hardware wallet makers and their third-party partners.
The SafePal breach also follows the massive Coldcard hardware wallet exploit, in which attackers drained more than $130 million in Bitcoin by abusing a five-year-old firmware flaw that generated weak recovery seeds. Galaxy Research recently assessed that Coldcard attackers likely used unrestricted AI models to identify and exploit the vulnerability.
The incident echoes the infamous 2020 Ledger breach, which exposed more than one million email addresses and hundreds of thousands of customer records, kicking off a phishing and physical-extortion campaign that continues to haunt affected users years later.
According to Chainalysis data cited in Trezor’s disclosure, roughly $30 million had already been stolen in violent crypto attacks by mid-2026, with home invasions accounting for 37% of incidents.
What Users Should Do
Affected SafePal customers should treat any unsolicited email, phone call, letter, or courier delivery claiming to come from SafePal as suspicious, verify all communications through official channels, and under no circumstances share their seed phrase or private keys, even if a caller already knows their name, address, and past order details.
Users who suspect their wallet may have already been compromised through phishing should migrate their funds to a freshly generated wallet without delay.
Also Read: Binance Account Rental Scam: How Fraudsters Lure Crypto Users with Promises of Easy Money
