SafePal Breach Hits 39,798 Customers Through Order-Tracking Plugin Flaw

SafePal went public on August 16 with a data breach. Nearly 40,000 customers had their personal details exposed through a flaw in an order-tracking plugin — and the company didn’t catch it for months.

The numbers are specific: 39,798 users. Orders placed between March 2, 2025, and April 11, 2026. Data exposed includes names, email addresses, shipping addresses, phone numbers, and purchase information. Not a vague, hand-wavy “some customer data” disclosure — this is granular, and SafePal laid it out plainly. The company said the flaw was an authorization defect, meaning the plugin allowed unauthorized access to customer order records that should have been locked down. SafePal says the flaw has since been fixed, and additional security measures are now in place.

Worth noting: no seed phrases. No private keys. No wallet passwords, no payment card numbers, no government ID numbers.

How the Breach Went Undetected for Months

The timeline here is pretty telling. A phishing report landed in SafePal’s inbox in early May. At the time, the company treated it as an isolated incident — one bad actor, one suspicious link, move on. It wasn’t until a formal security investigation in July that the real problem surfaced: the plugin flaw had been sitting there, quietly exposing order data. That gap between May and July is the kind of thing that keeps security teams up at night.

And there’s another layer to it. SafePal also disclosed that a data-cleanup process had malfunctioned. Older order records were supposed to be deleted but weren’t, which is why the breach window stretches all the way back to March 2025. Without that cleanup failure, the exposure would have been narrower. Instead, more than a year’s worth of orders sat accessible to whoever found the vulnerability first.

SafePal says it has since rebuilt the order-processing system from the ground up. It’s also cut personal data retention down to 90 days, in line with legal requirements. Affected customers’ data has been removed from active servers, though an encrypted offline copy is being kept for potential investigations.

Phishing Risk Is the Real Threat Now

The breach didn’t touch wallets directly. But the exposed data — names, addresses, phone numbers, purchase history — is basically a phishing kit. SafePal knows it, and said so. The company has already taken down more than 30 fraudulent websites and phishing links tied to the breach. Thirty. That’s not a small cleanup operation.

See also: Trezor Data Breach Hits 13,689 Customers Through Logistics Partner Leak

SafePal was direct about the risk: the exposed information can and probably will be used to craft convincing phishing attempts targeting affected users. The advice is blunt — SafePal never asks for seed phrases, private keys, or passwords. If anyone contacts you claiming to be SafePal and asking for those things, it’s a scam. Full stop.

For users who think they may have already entered sensitive information into a suspicious site, SafePal’s guidance is to treat those wallets as compromised and move assets to a new wallet immediately. The company was careful to add that customers don’t need to move assets just because their order information was exposed — only if they have reason to believe wallet credentials were entered somewhere they shouldn’t have been.

Unclear still: who accessed the data, and how much was lost through phishing. SafePal said it hasn’t identified the unauthorized party and can’t confirm the total amount lost. Further updates are expected through official channels.

What SafePal Is Doing Next

SafePal set up a dedicated support channel for users reporting financial losses and said it’s working with on-chain asset-tracing specialists to help those cases. It was careful to clarify that opening this channel doesn’t mean it’s accepting liability or committing to compensation. That’s a legal hedge, basically, but it’s also a practical one — the company can’t know yet how many users were actually defrauded.

An independent third-party security firm is being brought in to validate the fixes and run a broader review of SafePal’s systems. No name given for the firm, and no timeline specified. The company also said its investigation hasn’t found evidence that the breach reached logistics and fulfillment partners’ systems — those networks appear to be clean.

See also: Canadian Dollar Hits Two-Month High as Factory Numbers Beat Forecasts

Crypto hardware wallet companies hold a tricky position. Customers trust them with physical shipping details precisely because they want security for their digital assets. When order data leaks, it doesn’t crack the vault — but it hands attackers a map of who owns one.

SafePal’s count of 30-plus fraudulent sites already dismantled suggests the attackers moved fast.