Data Breach Hits 39,798 Safepal Customers After Order Plugin Flaw

Safepal Discloses New Customer Data Incident: Almost 40K Users Involved

Safepal, a wallet manufacturer headquartered in the Seychelles, is facing a security crisis involving a subset of its users.

On Sunday, the company disclosed that it had suffered an unauthorized data breach involving 39,798 customers after a plugin used for order tracking suffered a flaw that allowed unidentified actors to access this information.

The data breach involved customers’ orders between March 2, 2025, and April 11, 2026, exposing potentially critical information, including names, email addresses, shipping addresses, phone numbers, and purchase details, to the attackers.

The company ensured that seed phrase, private keys, wallet password, or other wallet credentials were not extracted during this incident.

Safepal acknowledged that the breach might lead to sophisticated phishing attempts, including “fraudulent phone calls, emails, text messages, letters, refund offers, firmware-update requests, fake customer-support communications, malicious websites, or other attempts to obtain your wallet credentials or additional personal information.”

Even so, Safepal claims it fixed the issue and implemented new security measures to prevent similar breaches, including tightening the data retention period to 90 days and taking down 30 fraudulent websites linked to scam schemes.

Nonetheless, security researcher Tay stressed that it is unlikely this dataset was used only for phishing, as shipping addresses and personal data were disclosed, suggesting a higher risk for users whose addresses were breached.

Specter, another blockchain investigator, stressed that the company had been receiving reports of phishing attempts as early as April but did not disclose it until now. Tay confirmed that several cases were reported during spring and summer that might be linked to this leak.

A customer allegedly involved in the breach pointed out that the company had deleted his data before this disclosure, criticizing Safepal’s data retention policies.

Safepal’s announcement follows similar incidents at Trezor, with Shipmonk, its shipping provider, suffering a data breach that exposed the full names, email addresses, phone numbers, and shipping addresses of 11,742 customers in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.

The wave of breaches is worrying for users involved, as cryptocurrency holders have been targeted in so-called wrench attacks, particularly in France.