Brandon Fletcher
On Sunday, SafePal, a prominent crypto wallet provider, announced it had recently identified and resolved a vulnerability in its system that contained customer order information. This flaw, if exploited, could have allowed unauthorized individuals to access sensitive user data. Unfortunately, it appears that an unauthorized party did access this information, compromising the data of customers who placed orders from March 2 of last year until April 11 of this year.
While SafePal customers likely understand the implications, it is crucial for others to recognize that this breach does not mean any cryptocurrency was stolen or directly compromised. Similar to Ledger, which alerted users about a third-party data breach earlier this year, SafePal produces hardware wallets—devices that resemble a hybrid of a credit card and a compact smartphone. The breach specifically revealed the identifying information of 39,798 individuals who likely purchased SafePal devices.
According to SafePal, the compromised data includes “name, email address, shipping address, phone number, and purchase details.”
Dear community,
While your SafePal wallet, seed phrase, and private keys are secure; we identified a flaw in the order-tracking plug-in that led to unauthorized access to information of a subset of customers.
The issue has been fixed with additional security measures…
— SafePal – Crypto Wallet (@SafePal) August 16, 2026
Hardware wallets, such as those offered by SafePal, are designed to be secure storage options. These devices are typically air-gapped, making them theoretically impervious to hacking, thus providing a safe haven for the vital information necessary to execute blockchain transactions. Essentially, even if your phone or computer is compromised, possessing a hardware wallet—combined with strong security practices—ensures that your cryptocurrency remains secure.
Given that SafePal customers’ cryptocurrency remains safeguarded, the real concern lies in the fact that, as SafePal highlights, “affected customers might be targeted by more sophisticated phishing attempts.” This potential for phishing attacks is evidently significant for SafePal, as evidenced by the prominent warning about phishing on the FAQ page for users potentially affected by this breach, which prominently features the hashtag #BewareOfPhishing.
Consider this: an attacker may now have access to the phone numbers and email addresses of 39,798 individuals who possess enough cryptocurrency to invest in hardware wallets. These wallets serve as the keys to their substantial digital assets. With a bit of social engineering, potentially utilizing real names and localized details, attackers might believe they can extract cryptocurrency holdings from at least a few of their many targets.
This type of attack is often simpler—or at least less confrontational—than what is sometimes referred to as a “$5 wrench attack.” This term describes a growing trend in which an assailant brandishing a blunt object, or more commonly a firearm, confronts a victim and demands the key information that unlocks their crypto assets.
Stay vigilant and, uh, safe out there, friends.
Daniel Mercer
