SafePal, a notable crypto hardware wallet provider, recently announced a significant data breach impacting approximately 40,000 users. The breach occurred when hackers exploited a vulnerability within the order-tracking plugin used for customer orders, allowing unauthorized access to sensitive customer data.
Details of the Breach
In a statement, SafePal expressed regret over the incident, stating that the breach affected customers who placed orders from March 2, 2025, to April 11, 2026. The compromised data includes personal details such as names, addresses, email addresses, phone numbers, and order specifics.
On the same day of SafePal’s disclosure, a threat actor began promoting the stolen data on a cybercrime forum, confirming the impact on 39,798 individuals. SafePal has assured its users that no critical wallet information, such as seed phrases or private keys, was compromised.
Security Measures and Recommendations
SafePal advises potentially impacted customers to be vigilant against any suspicious communications asking for sensitive wallet information. Should any user have mistakenly shared their seed phrase or private key, SafePal recommends creating a new wallet using an official device or application and transferring assets immediately.
The breach investigation began in May after an initial report, initially treated as an isolated incident. However, a deeper probe revealed a systemic issue with prolonged data retention in the order-processing system, prompting a thorough review and overhaul of their security protocols.
Ongoing Response and Future Actions
In response to the breach, SafePal has implemented corrective measures, including fixing the exploited vulnerability and updating data retention policies. They have also partnered with third-party security experts to further investigate and mitigate the incident’s impact.
Furthermore, SafePal has actively worked to take down over 30 fraudulent websites and phishing links associated with the breach. Customers who suffered financial losses are encouraged to contact SafePal with relevant information, as the company is collaborating with on-chain asset-tracing specialists to assist in recovery efforts.
SafePal emphasizes that their current focus remains on facilitating recovery and supporting ongoing investigations, without admitting liability or committing to compensation at this stage.
