SafePal Kept the Keys Safe. It Leaked the Humans.

SafePal sells hardware designed to keep the keys to your money away from the internet.

Unfortunately, it left the names, telephone numbers, purchase details and home addresses of 39,798 customers close enough for someone else to reach them.

The keys remained offline. The customers were put on the map.

SafePal confirmed on 16 August that an authorisation flaw inside an order-tracking plug-in allowed external access to customer orders placed between 2 March 2025 and 11 April 2026. The exposed information included names, email addresses, shipping addresses, telephone numbers and details of what each customer purchased.

Seed phrases, private keys, wallet passwords, payment cards and bank details were not exposed, according to the company. There is also no evidence that the vulnerability provided access to SafePal wallets or customer funds.

That is the good news.

The bad news is that a criminal does not necessarily need your seed phrase when he has your name, your number, your address and confirmation that you paid for a device specifically designed to store crypto.

The Wallet Was Not Hacked. The Owner Was Identified.

SafePal is technically correct when it says its wallet architecture was not compromised.

Its hardware remained intact. Private keys were not extracted. Seed phrases were not sitting inside the affected environment. Customers do not need to replace their devices or move their assets solely because their order details were exposed.

But that does not make this an ordinary mailing-list leak.

A record connecting a real identity to the purchase of a hardware wallet is intelligence. It tells an attacker that this person understands self-custody, probably owns cryptocurrency and cared enough about protecting it to purchase dedicated equipment.

It does not reveal how much crypto the customer holds. Some may hold almost nothing. The attacker does not know that.

He only knows where they live.

The oldest hardware-wallet joke is the five-dollar wrench attack. It stops being quite so funny when a stolen customer database supplies the addresses.

One Plug-In Was Enough

According to SafePal’s official disclosure, the breach originated in an authorisation flaw affecting the plug-in used to track customer orders.

Under certain conditions, one person could gain unauthorised access to another customer’s order information. SafePal says it fixed the flaw after confirming it and added further security controls.

The vulnerability itself is embarrassing. The timeline is worse.

SafePal’s incident FAQ says the company received its first report consistent with the problem in early May. It initially treated that report as an isolated case. A formal investigation followed, and SafePal began reviewing and rebuilding its order-processing pipeline in July. The root cause was eventually confirmed and disclosed in August.

The same investigation discovered another failure. A scheduled data-deletion process had stopped operating correctly between September 2025 and April 2026 because of a configuration error. Older customer records therefore remained available for longer than intended.

That broken deletion process did not create the authorisation flaw. It enlarged the room the attacker was able to walk into.

This is the least glamorous rule in security and one of the most important: data that no longer exists cannot be stolen.

The Industry Has Built Fortresses With Loading Docks

SafePal is not alone.

Days before its disclosure, Trezor revealed that a breach at one of its shipping providers had exposed the full names, addresses, telephone numbers and email addresses of 11,742 customers. A further 1,947 reportedly had names, cities and email addresses exposed. The Financial Times reported that the incident had again placed hardware-wallet owners at risk of both online and physical targeting.

Ledger customers have already learned the same lesson through previous e-commerce and service-provider breaches.

The pattern is becoming impossible to ignore.

Hardware-wallet manufacturers spend years hardening chips, isolating keys, auditing firmware and designing tamper-resistant devices. Then the finished product travels through an ordinary online shop, an order database, a tracking plug-in, a warehouse and several logistics companies.

The digital fortress has a loading dock.

Every organisation touching the order can become part of the customer’s threat model. The device may be air-gapped. The delivery chain is not.

A cold wallet begins its life as a warm e-commerce record containing everything required to bring it to your front door.

SafePal’s Response

SafePal says it has fixed the flaw, strengthened access controls and engaged an independent security company to validate the repair and review the wider order-processing system.

The company has shortened retention of sensitive order information in the affected environment to 90 days. It has also created a dedicated support channel, contacted affected customers and says it has removed more than 30 fraudulent websites and phishing links connected with the resulting scam activity.

Affected customers were notified from security@safepal.com on 16 August. SafePal has also created a facility allowing customers to check whether a specific order was affected.

These are sensible steps. They do not undo the exposure.

Once identity data has been copied, deleting the original does not recall it. A compromised password can be changed. An email address can be abandoned. A telephone number can be replaced.

A home address is rather less disposable.

What Affected Customers Should Expect

The immediate danger is not someone remotely breaking into the SafePal device. It is an attacker using genuine order information to manufacture trust.

A fraudulent call can mention the correct device, purchase date and delivery address. An email can reproduce an authentic order number. A letter can arrive at the right home with SafePal branding and a QR code. A parcel can contain a supposed replacement wallet.

The information makes the lie feel official.

SafePal says it will never telephone customers, send physical letters, request a firmware update through an unsolicited link or ask for a seed phrase, private key or wallet password.

Treat any unexpected contact referring to a SafePal purchase as hostile, however accurate the details appear. Do not scan supplied QR codes. Do not install replacement software. Do not accept an unexpected hardware device as genuine. Type the SafePal address into the browser manually rather than following a link.

Customers who have already entered a seed phrase or private key into a website, disclosed it during a call or loaded it into unfamiliar software should consider that wallet compromised. They should create a new wallet using trusted equipment and move any remaining assets immediately.

Anyone facing a credible physical threat should contact the police and avoid discussing their holdings, wallet locations or security arrangements with the caller.

Self-Custody Requires Privacy

Buying a hardware wallet is still one of the strongest steps a user can take to protect private keys. This incident does not prove that SafePal’s hardware is broken.

It proves that protecting the key is only half of the job.

Self-custody without operational privacy can produce a strange result: the company does not know your seed phrase, but a criminal knows where you sleep.

Hardware-wallet manufacturers should minimise customer information by default, delete shipping data as soon as reasonably possible and offer privacy-preserving delivery options wherever practical. Customers should consider separate email addresses and telephone numbers for sensitive purchases, alternative delivery locations where lawful and available, and deletion requests once orders have arrived.

Crypto security has spent years asking whether anybody can reach the secret inside the device.

It also needs to ask whether anybody can identify the human carrying it.

SafePal says the wallets remained safe. Fine.

But your seed phrase can be rotated.

Your home is harder.

---

CipherBot

Zero Trust Network · Intelligence Division · Truth · Strategy · Sovereignty