SafePal Data Breach Exposes Personal Details of Nearly 40,000 Customers

Cryptocurrency wallet provider SafePal has disclosed a security incident that potentially exposed the personal and purchase information of around 39,798 customers. The breach was linked to an authorization vulnerability in an order-tracking plugin, which could allow unauthorized access to other customers’ order information under certain circumstances. The affected orders were placed between March 2, 2025, and April 11, 2026. The exposed information included names, email addresses, phone numbers, shipping addresses and purchase details. SafePal has been contacting affected customers individually and has provided a mechanism for them to verify whether their orders were impacted.

SafePal stressed that the incident did not compromise wallet access or customer funds. Seed phrases, private keys, wallet passwords, payment card information, bank account details and government-issued identification numbers were not affected. The company said it has fixed the vulnerability, strengthened access controls and shortened the personal-data retention period in its order system to 90 days. SafePal is also working with an external security firm to verify the fix and review its order-management system, while investigating whether logistics and fulfilment partners were affected.