The manufacturer of a popular cryptocurrency hardware wallet has told tens of thousands of its customers to be on the lookout for phishing attempts after it suffered a data breach.
SafePal published an update on August 16 claiming that order information linked to 39,798 customers had been compromised in a recent incident.
Customers who placed order between March 2, 2025 and April 11, 2026 are impacted. The stolen data includes names, email and shipping addresses, phone numbers and purchase details.
“This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers,” SafePal clarified.
“SafePal never requests, collects, processes or stores such information from customers. No evidence has been found that the incident itself compromised access to SafePal wallets or funds.”
Read more on crypto breaches: Coldcard Users Lose $89m After Bitcoin Wallet Is Hacked
The breach appears to have stemmed from a vulnerability in the firm’s order-tracking function for a plug-in.
“Under certain conditions, the flaw allowed unauthorized access to another customer’s order information. We remediated the issue upon discovery and introduced additional security measures,” SafePal explained.
The firm warned customers to expect “fraudulent phone calls, emails, text messages, letters, refund offers, firmware-update requests, fake customer-support communications” and other attempts to obtain their wallet credentials or additional personal information.
It said it had already taken down over 30 fraudulent websites and phishing links associated with the incident.
According to screenshots posted to X, an individual has put the stolen data up for sale, although their claims have not been verified.
Advice for SafePal Customers
SafePal has published a dedicated page via which to report scams, and a support channel for affected customers.
It issued the following advice:
- Never share your seed phrase, private key, or password with anyone, even if they claim to be a SafePal employee
- Don’t click links or scan QR codes in unsolicited emails, text messages, or letters claiming to be from SafePal
- Type the SafePal web address manually into the browser rather than following a redirected link, including any link that appears to come from this notice
- Be on the lookout for any suspicious communication or impersonation, whether by phone, post or in person
- Report anything suspicious, including messages, calls, letters or websites
