SafePal, a prominent cryptocurrency wallet provider, has disclosed a security incident where unauthorized individuals accessed customer order information. This breach affected approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The compromised data includes names, email addresses, shipping addresses, phone numbers, and purchase details.
The breach originated from an authorization flaw in a plug-in used for customer order tracking. Under specific conditions, this vulnerability allowed unauthorized access to other customers’ order details. Upon discovery, SafePal promptly addressed the flaw and implemented additional security measures to prevent future occurrences.
Importantly, the breach did not expose sensitive information such as seed phrases, private keys, wallet passwords, bank account data, payment card numbers, or government-issued identification documents. SafePal has confirmed that there is no evidence suggesting that the incident enabled attackers to access SafePal wallets or steal cryptocurrency assets.
However, the exposure of personal information increases the risk of phishing attacks. Cybercriminals could exploit the leaked data to craft convincing fraudulent messages, including fake support emails, phone calls, text messages, refund offers, firmware-update requests, delivery notifications, or malicious links aimed at stealing wallet credentials.
SafePal has proactively notified affected customers via email from [email protected], with the subject line: “[Important] Your SafePal Order Information Has Been Affected.” Customers are advised to verify any communication through SafePal’s official website rather than relying on links provided in messages. A dedicated support channel has been established for those impacted by the incident.
In response to the breach, SafePal has reduced the retention period for personal data in the affected order-processing environment to 90 days, in compliance with legal requirements. The company is also collaborating with an independent third-party security firm to validate the remediation efforts and review its broader order-processing systems.
Customers are reminded never to share their seed phrases, private keys, or wallet passwords with anyone claiming to represent SafePal. The company will not request these credentials through email, phone calls, text messages, social media, or any other communication channel. Users should avoid clicking on links or scanning QR codes in unexpected messages and should manually type the SafePal web address into their browser when accessing account or support information. Notably, attackers have used lookalike domains, including those that replace the lowercase letter “l” with an uppercase “I.”
For customers who have already entered their seed phrase or private key into a suspicious website, it is recommended to treat the wallet as compromised. They should create a new wallet through an official SafePal device or application and transfer any remaining assets immediately.
This incident underscores the critical importance of robust security measures and vigilant user practices in the cryptocurrency space. As digital assets continue to gain popularity, both companies and users must remain proactive in safeguarding sensitive information against evolving cyber threats.
