SafePal's leaked order book is a target list: 39,798 wallet buyers, with addresses

Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data.

SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information.

A threat actor claims to be selling the stolen SafePal customer data on a cybercrime forum; as spotted by DarkWebInformer, the seller referenced the same affected order period and approximately 39,798 customers disclosed by SafePal.

"Not interested in low balls , please come correct and with a good price or do not message me at all," reads the forum post.

SafePal says it notified all impacted customers via email on August 16 with the subject "[Important] Your SafePal Order Information Has Been Affected."

BleepingComputer has not independently verified that the threat actor possesses the stolen data.

SafePal launched an online verification tool that lets customers enter their order number and shipping country to determine whether the details of that order were stolen.

The company warns that the stolen information could be used to conduct targeted phishing and other social engineering attacks, with customers reporting SafePal phishing emails and phone calls as early as May.

SafePal says it first received a report consistent with the incident in early May 2026, which it initially treated as an isolated case before escalating it into a formal security investigation and introducing additional protections.

SafePal advisory: "As our e-commerce system involves multiple interconnected components and external integrations, as well as third-party logistics partners, we could not immediately rule out several possible explanations."

In July, SafePal began what it described as a "full review and rebuild" of its order-processing system and discovered an authorization flaw in the order-tracking function of a plug-in that allowed unauthorized access to another customer's order information; it determined a threat actor exploited the flaw to steal order information for approximately 39,798 customers.

SafePal says it fixed the vulnerability and implemented additional security measures, and is working with a third-party security firm to validate the fix and conduct a broader review of its order-processing systems.

SafePal warns customers to watch for targeted phishing emails and phone calls about firmware upgrades, product returns, refunds, or legal investigations.

The company says it has already taken down more than 30 fraudulent websites and phishing links tied to this incident.

A customer posted on X that they received a SafePal phishing email and a phone call from someone claiming to be a company employee in May; the phishing email claimed a security vulnerability had been discovered in the SafePal X1 hardware wallet and that a firmware update was required.

SafePal says customers whose order information was exposed do not need to replace their hardware wallets.

SafePal discovered a separate configuration error that caused a data-cleanup process to stop functioning correctly between September 2025 and April 2026, resulting in order data being retained as far back as March 2025.

For affected orders, SafePal says it has purged personal data from active e-commerce servers, although it is retaining an encrypted offline copy for potential law-enforcement investigations.

The exposed order window covers about thirteen months of customer orders.

About three months passed between SafePal's first report consistent with the incident and its notification of affected customers.

The broken data-cleanup process went uncorrected for roughly seven months.

SafePal's customer-facing verification tool also serves as an authenticity check for buyers of the stolen data, because the seller supplies order IDs and shipping countries that can be validated through it.

Because the leaked fields include name, phone number, shipping address and purchase information but no credentials, the data set functions as a list of confirmed hardware-wallet purchasers with their physical locations and contact numbers.