The SafePal data breach exposed the names, email addresses, phone numbers, shipping addresses and purchase details of about 39,798 customers who ordered between 2 March 2025 and 11 April 2026, and SafePal says no seed phrases, private keys, wallet passwords, card numbers or bank details were part of it. Your crypto isn't at risk from the leak itself. The risk is that a list of SafePal owners, with home addresses attached, may now be for sale, so the scams aimed at those owners are the thing to prepare for.
What the SafePal data breach exposed
SafePal disclosed the incident on 16 August 2026 in a security update and emailed affected customers the same day from security@safepal.com. The cause was an authorization flaw in the order-tracking function of a plug-in on its store, which under certain conditions let one person pull up another customer's order. SafePal hasn't named the plug-in. It says the flaw is fixed and that extra security measures are in place.
The fields that leaked are the ones a fulfilment system needs to get a parcel to your door: your name, email, phone number, shipping address and what you bought. Payment card numbers, bank accounts and government ID numbers were outside the affected data, according to SafePal, and so was everything that controls a wallet. SafePal points customers to that 16 August email as the way to confirm whether their order was affected, and the date window gives you a quick first check: orders placed before 2 March 2025 or after 11 April 2026 fall outside it.
The update two days later
On 18 August SafePal added that people online were claiming to own the dataset and offering it for sale. The company said it couldn't verify those claims and would assess anything that got published, and it also said it had taken down more than 30 fraudulent websites and phishing links and was arranging a third-party investigation and audit. It cut its retention period for personal data in the affected environment to 90 days.
Taken together, those details point at how this leak is likely to be used. A buyer list of a wallet brand is a ready-made target file for phishing, and fake support sites only work if someone sends you to them.
If you're a SafePal customer
Start with the scams that follow every one of these leaks, because they'll arrive first. SafePal's own guidance comes down to a few habits:
- Never give your seed phrase, private key or password to anyone, including someone who says they're from SafePal support.
- Don't click links or scan QR codes in messages you didn't ask for, and type safepal.com into the browser yourself.
- Treat an unexpected parcel, letter or "replacement device" tied to your order as hostile, and never enter your recovery phrase into a device you didn't buy.
- Report suspicious contact through SafePal's scam-protection page.
If you've already typed your recovery words into a site or shared them with someone claiming to help, SafePal's advice is to create a new wallet and move what's left to it straight away. A fresh wallet means fresh words generated on the device, since the old phrase can't be made private again.
There's also the address itself. Chainalysis counted more than 30 million USD stolen in violent attacks on crypto holders in the first half of 2026, and its analysts link part of that rise to leaked lists that name holders. You can't take an address back out of a leak, but you can stop advertising it further: don't post about your holdings, use a separate email for crypto purchases, and keep your recovery backup somewhere other than a drawer by the front door.
How this fits the year's other wallet leaks
SafePal disclosed four days after Trezor, whose shipping provider ShipMonk was breached and which later put the total at 80,689 people, as we covered in our piece on the Trezor ShipMonk breach. Ledger had its own leak through an e-commerce partner in January, which we covered in Ledger's January 2026 data breach, and Keystone followed in October with a store breach that later reached its device authentication key, explained in our piece on the Keystone data breach. Each of these came from the shop, shipping or payments side of the business, and none reached the wallets themselves.
That pattern matters if you're weighing SafePal as a first hardware wallet. A breach at a store tells you how a company handles customer data, which is worth knowing, but very little about how its device protects keys. The device questions are separate: how keys are generated and stored, how you back them up, and whether the screen shows you what you're signing before you approve it.
If you're still choosing a wallet
Order directly from the maker or an authorized reseller, ask how long the seller keeps your shipping details, and consider a pickup point or work address for delivery so a future leak reveals less about where you live. Our guide on where to buy a hardware wallet safely covers the buying side, and our checklist on your first hardware wallet covers the device questions that should decide which one you pick.
Share: