SafePal Breach Exposes 39,798 Buyers as Stolen Records Hit Cybercrime Forum

SafePal disclosed on Aug. 16 that a flaw in an order-tracking plug-in exposed the personal data of 39,798 customers, and a threat actor is already advertising the records for sale on a cybercrime forum.

The file pairs home addresses and phone numbers with proof of hardware wallet ownership, which makes it a targeting list for phishing and for physical robbery. It is the second hardware wallet customer database exposed in three days.

SafePal, the Binance-backed wallet maker, said in its incident report that it found “an authorization flaw in the order-tracking function for a plug-in associated with customer order information.” Orders placed between March 2, 2025, and April 11, 2026 were affected, exposing names, email addresses, shipping addresses, phone numbers and purchase details. Seed phrases, private keys, wallet passwords, bank account information and payment card numbers were not compromised, the company said, and it found no evidence the incident gave anyone access to wallets or funds.

Order IDs As Proof

BleepingComputer reported that a seller on a cybercrime forum is offering the data and vouching for it by sharing order IDs and shipping countries that buyers can check against SafePal’s own lookup tool.

SafePal said it emailed affected customers on Aug. 16 and has “identified and taken down over 30 fraudulent websites and phishing links tied to the scam activities.” It cut the retention period for personal information in the order-processing environment to 90 days and is engaging an independent security firm to validate the fix.

Customers were reporting phishing months before the disclosure. SafePal’s scam-protection page carries the question: “I received phishing emails in May. Why did it take until August to confirm the cause?”

Second List In Three Days

Trezor disclosed on Aug. 13 that a breach at fulfillment partner ShipMonk exposed names, phone numbers and shipping addresses for 13,689 of its customers, the first leak of that kind since the company was founded in 2013.

Chainalysis counted 46 violent crypto robberies globally through late June and about $30 million stolen, against $58 million for all of 2025.

SFP traded at $0.24 on Monday afternoon, up 7.9% over 24 hours and 1.3% on the week, per CoinGecko.