Wallet provider SafePal says data breach exposed personal info of nearly 40,000 customers

Crypto wallet provider SafePal said in an X post on Sunday that an authorization flaw in its order-tracking system allowed unauthorized access to the personal data belonging to approximately 39,798 customers.The exposed information includes customer names, email addresses, shipping addresses, phone numbers, and purchase details, according to SafePal's incident report. The information in question belongs to customers who placed orders with SafePal between Mar. 2, 2025, and Apr. 11, 2026."This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers," SafePal wrote. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds."The company warned that attackers might target affected users with phishing and impersonation attempts, posing as SafePal employees to offer firmware updates, refunds, or replacement devices before attempting to glean wallet credentials from those users.SafePal has not disclosed when the flaw was introduced, when customer records were first accessed, or how many attackers may have obtained the data. SafePal did not immediately respond to emailed questions from The Block.Timeline of the investigationSafePal said in an incident Q&A that it received the first report consistent with the breach in early May, but "treated it as an isolated case at the time." The firm later escalated the issue, and "began a full review and rebuild of our order-processing pipeline in July, and confirmed the root cause mentioned during the investigation."Some public complaints predated SafePal's Sunday disclosure. A Trustpilot review by user "Jay Teng" dated July 4 alleges that scammers impersonated SafePal and contacted Teng with "all my account information." The scammers then allegedly directed Teng to a fraudulent website under the address safepal.support to "get a replacement hard wallet."A Reddit post from July 3 also reported being contacted by someone who knew the user's "name, address, phone, email, and my order details from my purchase last year" and directed to the safepal.support website. The Block could not independently connect the accounts, which were first highlighted by blockchain analyst Specter on X, to the breach.In response to Specter's post, SafePal said it "carried out investigations at the time but did not discover any breaches."SafePal also said it has identified and taken down more than 30 fraudulent websites and phishing links tied to the scam. The company did not disclose whether any customers were confirmed to have lost funds, but said it was contacting asset-tracing specialists and asked anyone reporting a loss to submit details through its support channel.Wallet providers face repeated customer-data exposuresSafePal’s disclosure follows two recent incidents involving commerce systems used by other hardware wallet providers.On Thursday, The Block reported that a breach at wallet provider Trezor's shipping partner ShipMonk exposed information belonging to nearly 14,000 customers. Names, phone numbers and full shipping addresses were exposed for 11,742 customers, while another 1,947 had their names, cities and email addresses exposed.SafePal said in its reply to Specter that its disclosure of the issue days after Trezor's announcement was merely "an unfortunate coincidence outside of [SafePal's] control."In January, wallet maker Ledger notified some customers that names and contact information had been exposed at Global-e, the third-party commerce provider that handled some purchases made through Ledger’s website.In each case, the companies said their wallets and private keys remained secure.Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.