SafePal Wallet Confirms Data Breach Affecting Nearly 40,000 Customers

The Breach and Root Cause

SafePal, a mobile cryptocurrency wallet service, confirmed a data breach that exposed personal information for 39,798 customers. The company attributed the incident to a flaw in its order-tracking system. Private keys, seed phrases, and crypto assets stored on the platform were not compromised and remained completely secure.

What Data Was Exposed

The breach exposed customer names, contact details, purchase data, and shipping information. SafePal did not specify additional fields such as email addresses, phone numbers, transaction history details, or linked bank account information beyond what was confirmed. The company's statement that cryptographic material and funds themselves were protected limits the immediate financial risk to users, though exposed order and shipping data could enable targeted phishing campaigns or social engineering attacks.

Hardware Wallet Security Context

The SafePal incident reflects a broader pattern of attacks on hardware wallet infrastructure, where data leaks have preceded or accompanied significant theft. CryptoSlate reported the breach occurs amid escalating hardware wallet attacks, with prior incidents resulting in over $100 million in losses. The distinction between compromised metadata and untouched cryptographic keys mirrors incidents at other custodial platforms, where the separation of hot systems from cold storage has proven effective in preventing asset theft, though user data remains vulnerable. The order-tracking system flaw suggests SafePal's backend infrastructure may lack sufficient access controls or data segmentation between customer-facing systems and sensitive user databases.