Crypto wallet provider SafePal recently disclosed a security breach that exposed the personal information of nearly 40,000 customers. According to the company, a vulnerability in an order tracking plugin allowed unauthorized access to data belonging to users who placed orders between March 2 of last year and April 11 of this year. Specifically, the leaked information includes names, email addresses, shipping addresses, phone numbers, and purchase details for 39,798 individuals.
It is important to note that this incident does not mean any cryptocurrency was actually stolen. Because SafePal produces hardware wallets designed to keep private keys offline and away from internet connected devices, the digital assets themselves remain secure. The breach occurred within the ordering system rather than the encrypted storage mechanisms of the devices, meaning seed phrases and private keys were not compromised during the event.
Despite the safety of the funds, SafePal has issued urgent warnings regarding an increase in sophisticated phishing attempts targeting affected users. Attackers now possess a curated list of people confirmed to own hardware wallets, making them prime targets for social engineering scams. By using real names and addresses to build trust, hackers may try to trick victims into revealing their secret recovery phrases through fake emails or texts.
Company officials stated that they have since patched the flaw and implemented additional security measures to prevent similar leaks. For now, owners of these devices are encouraged to maintain strict security hygiene and ignore unsolicited communications requesting sensitive account information. While far less violent than physical theft methods used against crypto holders, these digital traps pose a significant risk to those whose identities were caught in the leak.
