SafePal Data Breach Exposes Personal Information of Nearly 40,000 Customers
Hardware wallet maker confirms order-tracking plug-in flaw led to unauthorized access of customer contact and shipping details.
Quick Look
- SafePal, a crypto wallet provider, reported a data breach affecting 39,798 customers due to a flawed order-tracking plug-in.
- Exposed data includes names and addresses, raising concerns about physical security risks for crypto holders amid rising 'wrench attacks'.
AI-generated summary
Why It Matters
SafePal is a non-custodial wallet suite backed by Binance and Animoca Brands. The incident follows recent security disclosures by other hardware wallet firms like Trezor and Ledger.
Bitcoin and crypto wallet maker SafePal said Saturday that a flaw in an order-tracking plug-in gave attackers unauthorized access to the personal information of roughly 39,798 customers, the latest breach to put a hardware wallet company's users at risk of being physically targeted.
In a statement posted to X, SafePal said the exposed data spans customers who placed orders between March 2, 2025, and April 11, 2026, and includes names, email addresses, shipping addresses, phone numbers, and purchase details.
The company stressed that wallet credentials themselves were untouched, saying seed phrases, private keys, wallet passwords, bank details, payment card numbers and government IDs were not involved. SafePal, a non-custodial wallet suite backed by Binance and Animoca Brands that says it serves 30 million users, said it has fixed the issue, notified affected customers by email, and set up a page to check exposure.
While no funds were directly stolen, the mix of names, home addresses, and evidence of crypto ownership is precisely the kind of data that can steer criminals toward high-net-worth holders. That concern has sharpened alongside a rise in so-called wrench attacks, in which victims are threatened or assaulted until they surrender their crypto.
Chainalysis documented 46 violent incidents in the first half of 2026 with more than $30 million stolen, calling the year on pace to be the worst on record, with home invasions increasingly overtaking kidnappings.
SafePal joins a growing list of wallet firms whose customers have been exposed through leaks. Just days earlier, hardware wallet maker Trezor disclosed that a breach at shipping partner ShipMonk compromised data on roughly 13,700 customers. The clearest cautionary tale remains Ledger, whose 2020 leak of some 272,000 customers' details led to a wave of phishing and, for some, ransom threats invoking violence.
The timing adds to a jittery stretch for self-custody users still shaken by the Coldcard exploit, which drained long-dormant Bitcoin through a firmware entropy flaw and pushed industry-wide losses toward $130 million.
SafePal apologized to its community and said it would post updates on its blog as its investigation continues.
What to Watch
AI outlook — possibilities, not facts
SafePal will release further updates on its blog regarding the investigation.
Very likely · Within days
Open Questions
- What specific technical vulnerability existed in the order-tracking plug-in?
- Will there be legal or regulatory repercussions for the company?
