Crypto wallet provider SafePal has disclosed that unauthorized parties accessed the order information of approximately 39,798 customers. The exposed data included names, email addresses, phone numbers, shipping addresses and purchase details.
The incident did not provide direct access to SafePal wallets or users’ crypto assets. However, the combination of physical addresses and hardware wallet purchase records could help scammers create more convincing attacks against affected customers.
SafePal data breach originated in order tracking system
According to SafePal’s security notice published on August 16, the incident resulted from an authorization flaw in the order-tracking function of a plug-in connected to customer order information. Under certain conditions, the flaw allowed one customer’s order details to be accessed by another party.
The breach affected approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The compromised records included customer names, email addresses, phone numbers, shipping addresses and information about purchased products.
SafePal said it has fixed the vulnerability and introduced additional security measures across its order system. The company is also working with an independent cybersecurity firm to verify the fix and conduct a broader review of its order-processing infrastructure.
Affected customers were notified on August 16 through emails. SafePal also created a separate verification page where users can check their status using their order number and shipping country.
Seed phrases and private keys were not exposed
The SafePal data breach did not affect the company’s wallet infrastructure or hardware devices. Seed phrases, private keys, wallet passwords and other wallet credentials were not included in the exposed records.
Bank account information, payment card numbers and government-issued identification documents were also unaffected. SafePal said it found no evidence that the incident compromised access to customer wallets or funds.
Customers whose order information was exposed do not need to replace their hardware wallets or transfer their assets solely because of the incident. Users who entered or shared a seed phrase or private key through a suspicious message or website should treat the wallet as compromised.
In that situation, SafePal recommends creating a new wallet through a trusted device or the company’s official application. Any remaining assets should then be transferred to the new wallet immediately.
What risks does the exposure of physical addresses create?
Attackers can use the leaked data to produce more credible phishing messages. A scammer who knows which product a customer purchased, along with their phone number and delivery address, could impersonate a SafePal employee or shipping company representative.
Possible methods include fake product return instructions, refund offers, mandatory firmware update notices and fraudulent customer support calls. Attackers may also send malicious links, physical letters containing QR codes or unexpected hardware packages to customers’ addresses.
SafePal said it has already taken down more than 30 fraudulent websites and phishing links connected to scam activity. The company continues to monitor new domains and submit removal requests for threats reported by users.
Affected customers should approach unexpected communications by email, phone, text message or post with caution. SafePal employees do not initiate phone calls and will never ask users to disclose their seed phrase, private key or wallet password.
The company also recommends typing the SafePal website address directly into a browser instead of following links in emails. Users should avoid scanning QR codes found in unexpected letters and should not use unsolicited hardware devices delivered to their address.
Incident follows Trezor customer data breach
SafePal’s disclosure came only a few days after Trezor announced a separate incident involving customer information. According to Trezor’s official statement, unauthorized access to systems operated by logistics provider ShipMonk affected approximately 13,689 customers.
The Trezor breach also exposed names, email addresses, phone numbers and shipping addresses. The company’s wallets, devices and customer funds remained secure.
The two incidents show that hardware wallet security risks extend beyond devices and private keys. E-commerce, order-processing and logistics systems also hold sensitive information that can connect crypto investors with specific physical addresses.
SFP price reaction remains limited
SFP, the native token of the SafePal ecosystem, did not experience a sharp sell-off following the disclosure. According to price data, the token was trading at approximately $0.23 at the time of writing.
SFP’s 24-hour price movement remained around 1%. The limited reaction suggests that the data breach has not yet triggered a significant loss of confidence in the token market.
