SafePal Data Leak Exposes Customer Order Details, but Wallet Funds Stay Untouched

SafePal has disclosed a security incident that exposed personal order information for nearly 40,000 customers, while confirming that crypto assets, private keys, and seed phrases were not compromised. The breach was traced to an authorization flaw in an order-tracking plug-in that allowed unauthorized access to other customers’ order records under certain conditions.

The company said the affected data covered orders placed between March 2, 2025 and April 11, 2026, impacting about 39,798 customers. Exposed details included names, email addresses, shipping addresses, phone numbers, and purchase information.

SafePal stressed that the incident did not involve seed phrases, private keys, wallet passwords, bank account information, payment card numbers, or government-issued identification numbers. It also said there is no evidence the breach compromised access to SafePal wallets or user funds.

That distinction matters because the main danger from this kind of leak is often not direct theft of funds, but targeted phishing, impersonation, and social engineering. With names, contact details, and shipping addresses exposed, attackers could potentially use the information to make scam messages look more convincing to hardware wallet owners.

SafePal said it fixed the issue after discovering it, notified affected customers by email on August 16, and tightened its retention period for personal order data to 90 days. The company also said it brought in an independent security firm to review the incident and has taken down more than 30 phishing sites and fraudulent links tied to the breach.

The company’s own guidance is clear that users do not need to move assets or replace their devices solely because of this incident. The breach affected order information, not the wallet’s cold-storage security architecture or the credentials needed to access funds.

Disclaimers: All contents in this article are for informational purposes only and does not constitute any form of advice.Third-party websites and their content are provided for informational purposes and user convenience only. Rola News does not control, endorse, or assume responsibility for any Third-party websites, including their content, accuracy, privacy practices, or any subsequent changes or updates made to them. This article is AI-assisted and has been reviewed by our editorial team.