SafePal breach exposes 40,000 customers as hardware wallet attacks escalate from data leaks to $100 million theft
SafePal disclosed a security incident that exposed personal data for about 40,000 customers through an authorization flaw in its order-tracking system. Affected records covered purchases from March 2025 to April 2026 and included names, emails, shipping addresses, phone numbers, and order details. SafePal said private keys, recovery phrases, passwords, card numbers, and wallet access were not exposed, and it found no evidence of wallet compromise or crypto theft. A separate cleanup/configuration failure also left older order records in the system longer than intended, widening the exposed dataset. The incident adds to a wave of hardware-wallet-related security problems this year, including breaches affecting Trezor and Ledger, and a severe Coldcard flaw that led to more than $100 million in Bitcoin theft. Even when keys are not exposed, leaked customer data can enable phishing, impersonation, and physical targeting of crypto holders.
