SafePal Says Personal Data of 39,798 Customers Was Exposed, Warns of Phishing

SafePal, a maker of cryptocurrency hardware wallets, said a security flaw in its order-tracking system exposed the personal information of nearly 40,000 customers.

The Block reported on August 16 that SafePal disclosed in a post on X that unauthorized access to customer data occurred because of an authentication flaw in the system. The company said 39,798 customers were affected.

The exposed information includes customer names, email addresses, shipping addresses, phone numbers and purchase histories. The affected customers placed orders between March 2, 2025, and April 11, 2026.

SafePal said seed phrases, private keys and wallet passwords were not exposed. It also said bank account information, payment card numbers and government-issued identification numbers were not compromised, and that it found no evidence of unauthorized wallet access or asset theft.

The company warned affected customers about the risk of follow-on attacks. Attackers may impersonate SafePal employees and try to steal wallet credentials by using firmware updates, refunds or replacement devices as a pretext.

SafePal did not disclose when the flaw was introduced, when customer data was first accessed or how many attackers obtained the data. It also did not immediately respond to The Block's emailed questions.

Evidence of the breach had surfaced before the disclosure. In a Reddit post on July 3, a user said they had been contacted by someone who knew their name, address, phone number, email and purchase history, and was directed to a scam website called "safepal.support." SafePal said it has so far identified and blocked more than 30 related scam sites and phishing links.

The incident is the latest in a string of customer data leaks in the hardware wallet industry. About 14,000 customers' information was previously exposed at Trezor's shipping partner, ShipMonk, while Ledger said in January that some customer data was exposed through a third-party commerce vendor. The companies have said the wallets themselves and private keys remained secure.