Crypto wallet SafePal reveals a data breach exposing nearly 40,000 customers' order info
SafePal disclosed a security breach that exposed the names, physical addresses and contact details of 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The company said no cryptocurrency funds, seed phrases, private keys, bank details or govern…
Intelligence analysis by Llama
SafePal, a cryptocurrency security company, revealed a data breach that exposed the personal information of thousands of customers. The breach did not compromise any cryptocurrency funds, passwords, or private wallet keys, but users who shared their private keys or seed phrases via a phishing email, phone call, or letter should treat their wallet as compromised and transfer their asse…
Imagine you're at a store, and you can see another customer's receipt and delivery details just by changing the order number. That's what happened with SafePal's data breach. Thousands of customers had their personal information exposed, but their cryptocurrency funds and private keys were safe. Now, users who shared their private keys or seed phrases via a phishing email, phone call, or letter should treat their wallet as compromised and transfer their assets to a new wallet.
Analysis
Data Breach Details
SafePal, a cryptocurrency security company, revealed a data breach that exposed the personal information of thousands of customers. The breach occurred due to an 'authorization flaw' in a plug-in used to track customer orders, which allowed attackers to see other customers' orders. The breach has impacted 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.
Security Measures
SafePal has taken several steps to address the situation. The company has patched the vulnerability and introduced additional security measures in response. SafePal notified all affected customers by email from security@safepal.com on Sunday and hired an independent third-party security firm to audit the fix and review its order-processing systems. SafePal also said it would retain customers' personal data in its order-processing system for only 90 days from the date of collection.
Customer Response
Customers can use a verification tool on SafePal's website to check whether their data was affected, the company said. SafePal also identified and removed more than 30 fraudulent websites and phishing links associated with the breach. Users who have shared their private keys or seed phrases via a phishing email, phone call, or letter should treat their wallet as compromised and transfer their assets to a new wallet.
Industry Impact
The data breach highlights the importance of secure storage and management of digital assets, and the need for users to be cautious when sharing sensitive information. The breach also validates calls to assess concentration risk and, where appropriate, to diversify both crypto holdings and the wallets used to store them.
Key points
- SafePal disclosed a data breach that exposed the names, physical addresses and contact details of 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.
- The company said no cryptocurrency funds, seed phrases, private keys, bank details or government IDs were compromised, but warned that exposed users face heightened phishing and impersonation risks.
- SafePal has taken several steps to address the situation, including patching the vulnerability and introducing additional security measures.
- Customers can use a verification tool on SafePal's website to check whether their data was affected, and users who have shared their private keys or seed phrases via a phishing email, phone call, or letter should treat their wallet as compromised and transfer their assets to a…
SafePal's swift response to the data breach and its commitment to customer security may help to restore trust in the company and its products. Additionally, the breach may prompt users to be more cautious when sharing sensitive information and to take steps to secure their digital assets.
The data breach may lead to a loss of trust in SafePal and its products, potentially resulting in a decline in sales and revenue. Additionally, the breach may expose users to phishing and impersonation attempts, which could lead to financial losses and other negative consequences.
