SafePal order-tracking flaw exposed data of nearly 40,000 wallet buyers

Cryptocurrency wallet maker SafePal disclosed that an authorization flaw in a third-party order-tracking plug-in exposed personal data of about 39,798 customers, and a threat actor is now selling it. The flaw worked like a parcel tracker that lets one customer see another's order simply by changing the order number, exposing names, email addresses, shipping addresses, phone numbers, and purchase details for orders placed between March 2025 and April 2026. Seed phrases, private keys, wallet passwords, and payment data were not affected. SafePal warned customers to expect phishing and impersonation, and noted that a fake firmware-update lure had already been seen. It has taken down more than 30 fraudulent sites.

Check

Affected SafePal customers should be alert to phishing and calls impersonating the company, never enter a seed phrase or approve a firmware update prompted by an unsolicited message, and verify notices independently.

Affected

About 39,798 SafePal customers whose names, emails, phone numbers, and shipping addresses were exposed; wallets and keys are safe, but the data supports convincing phishing, including fake firmware-update scams already observed.

Fix

Anyone who shared a seed phrase or keys through a scam should move funds to a new wallet now; organizations should audit third-party plug-ins for authorization flaws limiting customer data.