Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingSafePal security incident: Nearly 40,000 customer order data was compromised
Unmanaged crypto wallet provider SafePal reported that its order tracking plug-in contained a technical flaw that resulted in unauthorized external access to the order details of approximately 40,000 customers.
Technical defect causes order information to be leaked
The company confirmed the security incident after discovering a loophole in the order tracking plug-in used on its e-commerce platform. The vulnerability allows unauthorized third parties to access customer data placed on orders between March 2, 2025 and April 11, 2026. The leaked information included the names, email addresses, shipping addresses, phone numbers and specific purchase details of 39,798 customers.
SafePal said it has notified all affected customers directly via email. The technical flaw has been fixed, and the company has taken additional measures to strengthen customer data security. The vulnerability allows external access to order details, but is not related to core wallet functionality.
Wallet certificates, assets and sensitive financial data were not affected
SafePal clarified that the leak did not involve the user's wallet mnemonics, private keys, wallet passwords, payment card numbers, government-issued ID numbers or bank account information. The company's cold storage architecture remains isolated from the e-commerce platform to ensure the safe storage of digital assets and wallet certificates without being affected by this incident.
In an official statement, SafePal emphasized that because the compromised e-commerce system is completely isolated from wallet services, hardware wallets, private keys and encrypted assets remain secure. However, leaked customer contact information can increase the risk of targeted phishing attacks or social engineering attacks.
This incident exposed order information such as the user's name, contact information, shipping address and order details. As a result, affected users may face more complex phishing attacks.
The risk of phishing increases, users need to be vigilant
Due to unauthorized access to personal order information, SafePal expects fraud attempts in the form of fraudulent phone calls, emails, text messages, false refund offers, forged firmware updates, impersonating customer service, and malicious websites. The company emphasizes that under no circumstances will users be required to provide sensitive wallet credentials such as a 12/24-word recovery mnemonic, private key or PIN code.
To address these risks, SafePal recommends that all customers remain highly vigilant and do not share confidential wallet information even when receiving seemingly official or urgent messages. Users should ignore any communications or links that require wallet keys or recovery mnemonics.
Although this incident did not directly compromise the wallet password or private key, the company recommends that any user who leaks a recovery mnemonic, PIN code or key due to suspicious communications should immediately transfer their assets to a new wallet to ensure security.
Given these circumstances, SafePal's experience highlights a broader market trend: Even in the most secure environments, customers can still be targets for social engineering attacks. As people turn to more powerful, decentralized and user-controlled solutions, Wall Street has begun to move towards the Web3 framework. Investors are now using platforms to deposit stocks and precious metals from leading U.S. companies directly into their crypto wallets. Through tokenization and automated pricing systems for real-world assets, these platforms eliminate the need for intermediaries and provide users with greater control and greater transparency.
SafePal once again emphasizes that users should not disclose recovery mnemonic words, PIN codes or private keys to anyone. Users who may have leaked sensitive information after a suspected phishing attack are advised to create new wallets and transfer remaining assets as soon as possible.
