SafePal, a Singapore-based cryptocurrency security firm, has confirmed a data breach impacting approximately 39,798 customers. The incident, disclosed on August 17, 2026, stemmed from an authorization flaw within an order-tracking plugin used by the company. This vulnerability allowed unauthorized access to customer order information for purchases made between March 2, 2025, and April 11, 2026.
The exposed data includes customers' names, email addresses, shipping addresses, phone numbers, and specific purchase details. SafePal emphasized that critical wallet credentials such as seed phrases, private keys, wallet passwords, bank details, payment card numbers, or government IDs were not compromised, as the company does not collect or store such sensitive financial information. There is no evidence that the breach directly led to unauthorized access to customer wallets or funds.
The disclosure followed a threat actor's attempt to advertise the stolen data on a cybercrime forum, claiming the same number of affected customers. SafePal has since confirmed the security incident and individually notified all affected customers via email on August 16, urging them to verify their status.
The company warned that the exposed order data could be leveraged by attackers for more sophisticated phishing attempts. These could include fake support calls, emails, fraudulent refund offers, deceptive firmware updates, or malicious websites designed to trick users into revealing additional information or wallet credentials.
While the breach itself does not necessitate moving assets, SafePal advised that any customer who has shared a seed phrase or private key in response to a suspicious message, website, phone call, or letter should consider that wallet compromised. In such cases, users should create a new wallet using a trusted SafePal device or official application and immediately transfer any remaining funds.
SafePal has implemented a fix for the identified vulnerability and introduced additional security measures. An independent security firm is reportedly reviewing the fix and the company's order-processing systems. Furthermore, SafePal has reduced its data retention period to 90 days for relevant information, contacted affected logistics partners, and established a dedicated support channel for inquiries.
The company has also identified and removed over 30 fraudulent websites and phishing links related to the incident. SafePal stated it would continue to monitor for scams, investigate potential risks, and provide updates through its official channels. Customers who have experienced financial losses directly linked to the breach are encouraged to contact SafePal, which is collaborating with specialists to trace stolen on-chain assets.
