SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers

Disclosure and notification

SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. The hardware wallet maker said all affected customers were notified individually by email on August 16 from se******@safepal.com, with the subject line “[Important] Your SafePal Order Information Has Been Affected.”

The exposed records did not include wallet credentials or financial information, according to SafePal, which said it has found no evidence that the incident itself compromised access to SafePal wallets or funds.

“This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers,” SafePal said.

Scope of the flaw

Under certain conditions, the flaw allowed unauthorized access to another customer’s order information, the company said, without naming the plug-in, its vendor, or the version affected. No CVE identifier has been assigned to the issue.

The affected orders were placed between March 2, 2025, and