Overview
- SafePal disclosed on Sunday that an authorization flaw in an order‑tracking plug‑in allowed unauthorized access to other customers’ orders and that roughly 39,798 orders placed between March 2, 2025 and April 11, 2026 were exposed.
- The leaked records included names, email addresses, shipping addresses, phone numbers, and purchase details while SafePal says seed phrases, private keys, wallet passwords, payment card numbers, bank account information, and government IDs were not exposed.
- In response SafePal patched the plug‑in, notified affected customers by email, launched an online verification tool, removed more than 30 fraudulent sites, shortened data retention to 90 days, and engaged an independent security firm to validate fixes.
- A threat actor is claiming to sell the stolen records on a cybercrime forum and targeted phishing tied to the incident was reported as early as May, so customers should ignore any requests for seed phrases or private keys and treat a wallet as compromised only if those secrets have been shared.
- The incident highlights a recurring risk in the hardware‑wallet industry where strong device security can be undermined by weaker e‑commerce plugins, third‑party integrations, or retention errors and follows similar order‑data exposures at other wallet vendors.