SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach that exposed the names, physical addresses and contact details of 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.

The company said an authorization flaw in a plug‑in used to track customer orders allowed attackers to view other customers’ order information, including names and delivery details. SafePal emphasized that no cryptocurrency funds, seed phrases, private keys, bank details or government‑issued IDs were compromised. The breach increased the risk of phishing and impersonation attempts, and the company advised users who had shared private keys or seed phrases through phishing emails, calls or letters to transfer assets to a new wallet.

SafePal patched the vulnerability and introduced additional security measures. It notified all affected customers via email from security@safepal.com on Sunday and engaged an independent third‑party security firm to audit the fix and review its order‑processing systems. The company also removed more than 30 fraudulent websites and phishing links associated with the incident and will retain personal data for 90 days from collection. Customers can verify whether their information was exposed using a tool on SafePal’s website.

The incident underscores the ongoing risk of software vulnerabilities in crypto storage solutions and highlights the need for users to verify wallet security practices.