SafePal says order-tracking flaw exposed 39,798 customers’ names and addresses
The company said wallet keys and funds were not compromised, but warned of elevated phishing and impersonation risk.
SafePal disclosed a breach tied to an order-tracking plug-in “authorization flaw” that exposed personal order details for 39,798 customers. The company said no seed phrases, private keys, or crypto funds were compromised, shifting the immediate risk to targeted phishing.
SafePal breach exposed 39,798 customers’ order details, not wallet secrets
SafePal said an “authorization flaw” in a plug-in used to track customer orders exposed personal order information for 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The exposed data included names, physical addresses, and contact details.
The mechanism SafePal described is an access-control failure in an e-commerce component, not a break of wallet cryptography. SafePal said the flaw “likely allowed attackers to see other customers’ orders,” effectively by changing an order number to pull up someone else’s receipt and delivery details.
SafePal also drew a hard boundary around what it says was not touched. The company said no cryptocurrency funds, seed phrases, private keys, passwords, bank account information, payment card numbers, or government-issued IDs were compromised.
That distinction matters for how traders should model the risk. This incident, as described, does not create a new on-chain drain vector by itself. It does create a clean dataset for social engineering, where an attacker can pair a real name and shipping address with a believable “support” narrative, and try to extract the only thing that actually moves funds in self-custody: a seed phrase or private key.
Phishing risk is the real trade-impact: how SafePal says to verify, respond, and what’s still unknown
SafePal said it notified affected customers by email from security@safepal.com on Sunday, though it did not specify the calendar date in its disclosure. The company said it patched the vulnerability and introduced additional security measures, and it hired an independent third-party security firm to audit the fix and review its order-processing systems.
On the user side, SafePal’s guidance is blunt because the failure mode is familiar. The company warned exposed users face heightened phishing and impersonation risk, and said anyone who has shared their private keys or seed phrases via a phishing email, phone call, or letter should treat the wallet as compromised and transfer assets to a new wallet.
SafePal said it has already identified and removed more than 30 fraudulent websites and phishing links associated with the breach, and it provided a verification tool on its website for customers to check whether their data was affected. It also said it will retain customers’ personal data in its order-processing system for only 90 days from the date of collection, tightening the exposure window if a similar control failure happens again.
The open questions are the ones that determine how long this stays a one-cycle headline versus turning into a sustained scam wave. SafePal described the flaw as something that “likely allowed” access, but it did not quantify confirmed attacker activity, whether data was merely accessible or actually exfiltrated, or how long the issue may have been exploited. The company also did not name the independent security firm, publish an audit scope, or give a completion timeline.
My read: data leaks don’t drain wallets, but they can drain traders
The filing-equivalent detail here is the root cause: an “authorization flaw” in order tracking. That points to a broken permission check in a commerce workflow, which is bad operational security but not the same category as a compromised signing environment, and SafePal’s statement that seed phrases, private keys, and funds were not affected is consistent with that.
The threshold that matters is whether the follow-on scam infrastructure scales, because names and physical addresses turn generic phishing into targeted impersonation that can bypass a lot of users’ “I ignore random DMs” hygiene. If SafePal pairs its patch with a named third-party audit and a clearer accounting of whether data was accessed or exfiltrated, this stays a contained access-control incident rather than a durable source of wallet-compromise losses.
