SafePal, a crypto wallet provider that says it serves 30 million users, has confirmed that personal and purchase information belonging to nearly 40,000 customers was accessed through a flaw in its order-tracking system, months after users began reporting targeted phishing attempts.
- The Binance-backed crypto wallet provider said in an Aug. 16 security update that the exposed information included names, email addresses, shipping addresses, phone numbers and order details.
- Approximately 39,798 customers were affected.
- The records concerned purchases made between March 2, 2025, and April 11, 2026, though SafePal didn't disclose when the unauthorized access began or how many times the information was accessed.
SafePal, which says its hardware, mobile and browser wallets serve 30 million users, said it had fixed the flaw and strengthened its access controls.
The company said seed phrases, private keys, wallet passwords, payment card details and government identification numbers weren't exposed.
SafePal.
- Founded in 2018, SafePal joined Binance Labs' first incubation program that year, received an undisclosed investment from Binance and launched its first hardware wallet, the SafePal S1, in 2019.
- The company later gained backing from Animoca Brands and Superscrypt, though it has not publicly disclosed its total private funding, and raised $5 million by selling 50 million SFP tokens through Binance Launchpad in 2021.
Phishing reports began in May
SafePal's incident FAQ says the company received its first report consistent with the exposure in early May but "treated it as an isolated case at the time."
It later opened a formal investigation and began a full review and rebuild of its order-processing system in July. SafePal didn't provide the date on which it established the flaw as the cause.
The investigation also found that an automated data deletion process had stopped working correctly between September 2025 and April 2026 because of a configuration error.
- That failure didn't expose the records, but it left older customer information in the system for longer than intended.
SafePal has since reduced its retention period for sensitive order information to 90 days. It has also retained an encrypted offline copy of the affected records for potential law-enforcement investigations.
The company said it had taken down more than 30 fraudulent websites and phishing links connected to the scam activity. Customers could face phone calls, emails, text messages, letters or unexpected hardware deliveries from scammers using their purchase details, it said.
SafePal didn't say whether customers had lost funds. Its FAQ directs anyone who believes the incident caused a loss to contact the company, which said it was reaching out to on-chain tracing specialists without accepting liability or promising compensation.
The disclosure follows a separate breach reported by Trezor days earlier. Personal information belonging to nearly 14,000 customers of the hardware-wallet manufacturer was exposed through one of its shipping providers, The Coinformer reported.