SafePal, a Binance-backed non-custodial wallet provider, has disclosed a data breach exposing the personal details of 39,798 users, including names, shipping addresses, phone numbers, and purchase data.
According to the company’s announcement, the breach impacted customers who placed orders with SafePal between March 2, 2025, and April 11, 2026. However, SafePal has assured users that private keys, seed phrases, and crypto assets are not compromised.
Crypto Hit By Safepal Breach
SafePal disclosed the flaw on X, attributing it to a flaw in the order-tracking plug-in that exposed the personal details of a small subset of customers. According to the post, the order information of customers who placed orders between March 2, 2025, and April 11, 2026, including names, shipping addresses, email addresses, phone numbers, and purchase details, was compromised.
“Dear community, while your SafePal wallet, seed phrase, and private keys are secure, we identified a flaw in the order-tracking plug-in that led to unauthorized access to information of a subset of customers.”
The company notified the affected users via email and stated that it had identified and fixed a verification defect in the plug-in that allows customers to track their orders. SafePal has also introduced additional security measures and removed over 30 fake websites and phishing links associated with the breach. However, a report by BleepingComputer states that at least one threat actor is selling stolen data from the breach on a cybercrime forum. Additionally, some users have reported phishing attempts as early as May.
Seed Phrases, Private Keys Secure
SafePal confirmed that seed phrases, private keys, wallet passwords, hardware wallets, and crypto assets were not compromised during the breach thanks to its cold storage architecture. Furthermore, the breach did not involve bank details, payment card numbers, or any government-issued identification number. SafePal has set up a dedicated tool for users to check if their details were compromised during the breach.
Implication For Safepal Users
While the breach did not compromise users’ funds or private keys, it exposed crucial personal details tied to users. This puts users at risk of phishing attacks or elaborate social engineering scams. SafePal has warned users to be wary of attempts to access wallet credentials, crypto assets, and other personal information through fraudulent emails, text messages, phone calls, letters, offers, phishing websites, fake firmware update requests, and customer support communication.
SafePal has also issued an advisory stating it would never ask for their recovery phrase, PIN, or private keys. The advisory added that users must move their funds to a new wallet if they had entered a seed phrase or private key on a suspicious website or in response to a suspicious message following the breach.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
