SafePal Data Breach Exposes 39,798 Customer Addresses

A data breach has affected SafePal, a Binance-backed maker of hardware and software crypto wallets. The incident occurred between March 2, 2025, and April 11, 2026, exposing order information for approximately 39,798 customers. However, the good news is that no cryptocurrency funds were compromised, as passwords, private keys, seed phrases, bank details, payment-card numbers, and government-issued IDs remained secure.

The breach was caused by an 'authorization flaw' in a third-party plug-in used for order tracking. This allowed attackers to view other customers' order details simply by manipulating order numbers. SafePal promptly patched the flaw and notified affected users via email from [email protected].

While the company's response has been criticized, it is worth noting that they have taken steps to rectify the situation. These include hiring an independent third-party auditor, reducing data retention to 90 days, removing over 30 fraudulent websites and phishing links, and providing customers with a tool to check if their details were compromised.

However, the real concern lies in the leaked customer addresses. A stranger cannot drain a wallet using this information alone, but they can engage in targeted phishing or impersonation, making it easier for attackers to gain access to sensitive information.