Crypto hardware wallet SafePal is notifying roughly 40,000 individuals that their personal information was stolen in a data breach.
Hackers, it says, exploited a vulnerability in the order-tracking function of a customer order information plugin to gain access to customer information.
“We are extremely sorry to inform the community that order information for customers who placed orders between March 2, 2025, and April 11, 2026,” SafePal says.
The compromised information includes names, addresses, email addresses, phone numbers, and order details.
“The affected data involves approximately 39,798 customers,” the crypto wallet says.
SafePal disclosed the data breach on Sunday, the same day that a threat actor started advertising on a cybercrime forum the theft of SafePal data. In line with SafePal’s disclosure, the attacker claims 39,798 people were affected.
The company underlines that no other customer-related information was affected.
“This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers,” it says.
Potentially affected individuals are advised to be wary of suspicious communication requesting their seed phrases or private keys.
“If you have already shared or entered your seed phrase or private key in response to a suspicious message, website, phone call, or letter, treat that wallet as compromised. Create a new wallet using a trusted SafePal device or official SafePal application, and move your remaining assets to the new wallet immediately,” SafePal notes.
According to the company, it started investigating the incident after receiving a report in May, but treated it as an isolated case. It later discovered that a bug in its system resulted in order-related data being stored for much longer than intended.
“To resolve this conclusively, we began a full review and rebuild of our order-processing pipeline in July, and confirmed the root cause mentioned during the investigation,” it notes.
The company says it has addressed the vulnerability exploited in the attack, tightened the retention period for order-related information, identified and notified the impacted people, contacted partners to ensure the issue did not propagate, and retained a third-party security firm to investigate.
SafePal says it has “identified and taken down over 30 fraudulent websites and phishing links tied to the scam activities, with continued active monitoring for new ones.”
The company urges customers who might have experienced a financial loss related to the incident to contact it and provide relevant details, as it has been contacting on-chain asset-tracing specialists.
“Note that this does not represent any admission of liability or commitment to compensation; our focus at this stage is supporting recovery and ongoing investigations,” SafePal notes.
Related: Fortune 500 Companies Hit in Azure Data Theft Campaign
Related: Trivy, Not LiteLLM Behind the 2,500 Org Compromise
Related: Over 1,000 Charities Hit by Beacon CRM Data Breach
Related: 14,000 Trezor Customers Impacted by Data Breach at ShipMonk
