SafePal security incident exposed customer data on Sunday. The hardware wallet provider disclosed the breach.
The exposed data included names and physical addresses. Contact details were also compromised. Nevertheless, no cryptocurrency funds were lost. Passwords and private keys remained safe.
What happened in the SafePal security incident
SafePal identified an “authorization flaw” in a tracking plug-in. This plug-in processed customer orders. The flaw likely allowed attackers to view other customers’ orders.
Think of it as a store’s parcel-tracking system. One customer could view another’s receipt. They could do this simply by changing the order number.
The breach impacted 39,798 customers. These orders were placed between March 2, 2025 and April 11, 2026.
What was not compromised
SafePal stressed that wallet core security remains intact. Seed phrases and private keys were not affected. Bank passwords and account information were safe. Payment card numbers and government IDs were also secure.
Nevertheless, users who shared private keys via phishing should act. They should treat their wallet as compromised. They should transfer assets to a new wallet.
How SafePal is responding
The company patched the vulnerability quickly. It also introduced additional security measures. SafePal notified all affected customers by email. The email came from security@safepal.com on Sunday.
An independent third-party security firm is auditing the fix. It is also reviewing order-processing systems. SafePal will retain customer data for only 90 days. This applies from the date of collection.
The company identified and removed over 30 fraudulent websites. These were phishing links associated with the breach.
Customers can use a verification tool on SafePal’s website. This will check whether their data was affected.