Singapore-based crypto hardware wallet maker SafePal disclosed on Sunday, August 16, 2026, that an authorization flaw in the order-tracking function of a customer order-information plug-in allowed unauthorized external access to the order records of approximately 39,798 customers. The company's own security update (safepal.com) states the exposure covers orders placed between March 2, 2025 and April 11, 2026, and includes names, email addresses, shipping addresses, phone numbers and purchase details. SafePal is emphatic that no seed phrases, private keys, wallet passwords, bank account data, payment card numbers or government-issued IDs were involved, and says no evidence has been found that wallets or funds were accessed. All eight sources reviewed here agree on the 39,798 figure; SecurityWeek, Help Net Security, Infosecurity Magazine, Security Affairs, CoinDesk and CNA all cite it without variance, and headline rounding to "40,000" or "nearly 40,000" is the only difference between them.
What Happened
SafePal's account, as published in its incident notice and echoed across the reporting, describes a verification defect rather than a network intrusion. In the company's words: "Recently, the team identified an authorization flaw in the order-tracking function for a plug-in associated with customer order information. Under certain conditions, the flaw allowed unauthorized access to another customer's order information."
The timeline that emerges from the sources is longer than the disclosure date suggests. SecurityWeek reports that SafePal began investigating after receiving a report in May 2026 but initially treated it as an isolated case. Help Net Security corroborates this, describing a report "consistent with the issue in early May" that was later escalated into a formal security investigation. SecurityWeek adds a detail the other outlets do not carry: SafePal subsequently found that a bug in its own systems caused order-related data to be retained far longer than intended, and that the company began a full review and rebuild of its order-processing pipeline in July.
Disclosure came the same day a threat actor began advertising the stolen dataset on a cybercrime forum, claiming the identical figure of 39,798 affected people. Infosecurity Magazine notes that the sale listing is known through screenshots posted to X and that the seller's claims have not been independently verified. SafePal has not publicly confirmed the authenticity of the forum listing, so treat the sale as credible but unverified.
Note one editorial discrepancy worth flagging: in contextualising the incident against the recent Coldcard hardware wallet compromise, Infosecurity Magazine cites losses of $89m while CoinDesk reports "at least $120 million." That figure concerns a separate incident and neither number should be attached to SafePal.
What Was Taken
The exposed record set is consistent across every source:
- Full name
- Email address
- Shipping address (physical)
- Phone number
- Purchase and order details
Volume: approximately 39,798 customers, covering orders placed over roughly a 13-month window (March 2, 2025 to April 11, 2026).
What was explicitly not taken, per SafePal and repeated by CNA, Infosecurity and Security Affairs: seed phrases, private keys, wallet passwords or other wallet credentials, bank account information, payment card numbers, and government-issued identification numbers. SafePal states it "never requests, collects, processes or stores such information from customers," and on its scam-protection page argues that its cold storage architecture "operates in an isolated environment, entirely separated from e-commerce servers."
The sensitivity here is not in any single field but in the combination. A verified name tied to a verified shipping address tied to a specific hardware wallet purchase on a specific date is, for this customer base, close to a targeting package. It identifies people who almost certainly hold cryptocurrency, tells an attacker roughly how much they invested in securing it, and tells them where that person physically lives.
Why It Matters
For most retail breaches, leaked order data is a nuisance. For a hardware wallet vendor it is a pre-qualified victim list, and the sources show that risk is not theoretical.
Help Net Security reports that one customer described on X receiving a suspicious email, a physical letter, and a phone call in May from someone claiming to represent SafePal, warning of a security issue with a recently purchased hardware wallet and directing them to click a link. The customer contacted SafePal and was told the communication was not genuine. Help Net Security is careful to state there is no confirmed connection between the exposure and that phishing attempt, though the timing and the information available to the impersonator overlap with the exposed dataset. That is one OUTLET-sourced anecdote drawn from a single customer post, and should be read as suggestive rather than proof of exploitation.
Infosecurity Magazine reports that SafePal has already taken down more than 30 fraudulent websites and phishing links associated with the incident, which indicates active adversary infrastructure buildout around this victim pool.
The physical-mail vector deserves particular attention. Shipping addresses enable scam letters containing QR codes, a technique already used against hardware wallet owners to deliver fake "recovery" or "firmware update" instructions. SafePal's scam-protection page addresses this directly, stating the company "will NEVER send physical letters" and instructing recipients not to scan any QR code. Physical mail bypasses every email gateway and URL-rewriting control an organisation has.
There is also a supply-chain dimension for corporate treasury and custody teams. If your organisation purchased SafePal devices through a corporate address between March 2025 and April 2026, that procurement record is now potentially in an adversary's hands.
The Attack Technique
This was an authorization failure in a web application component, not malware, credential theft or ransomware. Functionally it maps to broken object-level authorization, better known as IDOR: an order-tracking endpoint exposed through a plug-in did not adequately verify that the requester was entitled to the order record being returned. CoinDesk offers the plain-language version, comparing it to a store's parcel-tracking system letting one customer view another customer's deliveries. SafePal's own scam-protection page calls it a "verification defect in the plug-in for customers to track order progress."
Three structural details make this worse than the raw flaw:
Third-party plug-in surface. The vulnerable code lived in a plug-in attached to the order-information system, not in SafePal's core product. Bolt-on e-commerce components routinely inherit access to sensitive datasets without inheriting the security review the core product receives.
Data retention drift. Per SecurityWeek, order data was being stored far longer than intended because of a system bug. That is why a single authorization flaw could yield 13 months of records rather than a small recent window. Retention failures are what convert a bug into a breach.
Detection lag. The gap between the initial May report and the August 16 disclosure reflects an early triage decision to treat the report as an isolated case. SafePal did escalate and rebuild, but the interval between first signal and full scoping is where the dataset most plausibly left the building.
Neither SafePal nor any source has published a CVE, indicators of compromise, the identity of the plug-in vendor, or attribution for the threat actor selling the data.
What Organizations Should Do
-
Audit authorization on every object-retrieval endpoint, especially in plug-ins. Any endpoint that returns a record by identifier (order, invoice, ticket, shipment) must verify the authenticated session owns that object server-side. Test with real cross-account requests, not just role-based checks, and include third-party plug-ins and marketplace extensions in scope.
-
Verify that retention policy matches retention reality. SafePal's stated policy and its actual stored data diverged because of a bug. Query production directly for the oldest record in each customer-data table and compare against policy. Enforce deletion with scheduled jobs that are themselves monitored.
-
Fix the triage path for low-volume external reports. A single customer report in May described the actual flaw. Ensure any report alleging cross-account data visibility automatically escalates to a security investigation and a scope assessment, regardless of how isolated it looks.
-
Brief employees and treasury staff who may have purchased affected devices. Warn explicitly about phone calls, physical letters with QR codes, refund offers and firmware-update prompts. The single non-negotiable rule: no legitimate wallet vendor ever asks for a 12 or 24-word recovery phrase, PIN or private key, under any circumstances. SafePal further states its employees never initiate calls to customers and the company never sends physical letters.
-
Treat any wallet whose seed phrase was entered into a prompt as compromised. SafePal's guidance is to create a new wallet on a trusted device or the official application and move remaining assets immediately. Do not attempt to reuse the old wallet.
-
Add lookalike-domain monitoring for your own brand now, not after an incident. SafePal took down 30+ fraudulent sites reactively. Pre-registered brand monitoring and a published, easy-to-find scam-reporting channel (SafePal has stood one up at safepal.com/scam-protection) materially shorten the window in which phishing infrastructure operates.
-
Segment e-commerce and order-fulfilment data from anything security-critical, and say so. SafePal's ability to state credibly that cold storage is architecturally isolated from e-commerce servers is what kept this from becoming a fund-loss event.
Sources: 40,000 Impacted by SafePal Data Breach - SecurityWeek | SafePal Says 39798 Customers Hit by Data Breach | SafePal breach affects 39798 customers, data allegedly for ... | SafePal Data Breach Hits Tens of Thousands of Customers | Unauthorized Access To A Subset Of Customer Order ... | Safepal security vulnerability exposes data of 39,798 customers | Order Information Incident & Phishing Alert | Crypto wallet provider SafePal discloses data breach affecting near...