The latest SafePal security incident does not appear to have put customers' coins directly at risk, but it may have handed scammers valuable information for targeting wallet owners.

Summary:

• 39,798 SafePal customers may have had order information exposed

• The incident involved a third-party order-tracking function rather than wallet infrastructure

• The company says credentials needed to access users' crypto were not affected

SafePal said the incident was caused by a permissions problem connected to an order-tracking plug-in. Customers who bought products between March 2, 2025, and April 11, 2026 could be affected, with the company estimating the total at 39,798 users.

The exposed records were related to purchases and deliveries. They could contain a customer's name, email, phone number, shipping address and order information. For a crypto hardware manufacturer, that data carries an additional risk: it can reveal that a particular person owns a device used to store digital assets.

There is no indication that attackers obtained the information required to move funds. SafePal said seed phrases, private keys and wallet passwords were not exposed. Financial and identity data, including bank details, payment-card numbers and government IDs, were also not involved.

The company has already removed more than 30 fraudulent websites and phishing links associated with the incident. It expects criminals could use the leaked records to impersonate SafePal support, offer fake refunds, demand a supposed firmware update or direct users to malicious QR codes and websites.

SafePal says the technical weakness has been corrected and an independent cybersecurity firm will assess the fix. The company is also reviewing its order-processing systems and third-party fulfillment partners.

As another precaution, SafePal has shortened the retention period for personal information in the relevant environment to 90 days, except where longer storage is required by law.

The incident follows the recent Trezor customer-data breach involving its logistics provider, suggesting that for hardware-wallet companies, protecting customers now extends well beyond the security of the wallet itself.