A flaw in the page SafePal customers use to track their orders let one customer see another customer's order details. No cryptocurrency was stolen and no wallet was broken into. What was exposed were the names, email addresses, phone numbers and home addresses of 39,798 people, each of whom had just bought a device for storing crypto.
SafePal Bug Exposed Home Addresses of 40,000 Crypto Owners
17 August 2026 - 07:02 UTC
The Singapore-based hardware wallet maker has fixed the flaw. It cannot fix what followed. Funds can be moved to a new wallet, but a customer whose home address is now circulating has no equivalent remedy. A threat actor has advertised the dataset on a cybercrime forum, BleepingComputer reported, citing DarkWebInformer.
SafePal had a warning back in May
SafePal disclosed the incident on 16 Aug, saying it had "recently" identified an authorization flaw in an order-tracking plug-in. It did not say when. Its own scam-protection FAQ carries the question: "I received phishing emails in May. Why did it take until August to confirm the cause?" Affected orders were placed between 2 Mar 2025 and 11 Apr 2026, four months before customers were told.
Warnings now include the front door
Seed phrases, private keys, passwords and payment details were not involved, SafePal said. It told customers to treat unexpected contact about their purchase as suspect, whether by phone, in the post or in person, and to call local authorities over scam letters if worried about physical safety. Sandmark reported on 15 Aug that a French tax-data breach had raised similar targeting risks.
Rival Ledger warned customers in January that order data had leaked through a third-party merchant of record. Neither company's device failed. Both failed at e-commerce.
SafePal has cut data retention in the order system to 90 days and taken down more than 30 fraudulent websites. An independent security firm is being engaged, not yet appointed, to validate the fix. The company did not respond to questions from Sandmark before publication. Its token, SFP, swung 13% in the hour to 15:00UTC on 16 Aug before settling 0.5% below its pre-disclosure level, according to TradingView.
