SafePal's Order Tracker Leaked 39,798 Customer Records. The Seller's Proof Is SafePal's Own Breach Checker

What Happened

Hardware wallet maker SafePal, which counts Binance among its early investors, disclosed on August 16 that customer order data had been exposed through its online store. The company traced the incident to an authorization flaw in a 3rd-party plugin used for order tracking: under certain conditions, the plugin let one customer view another customer's order records.

The exposure covers 39,798 customers who placed orders between March 2, 2025 and April 11, 2026, and the records include names, email addresses, phone numbers, shipping addresses, and purchase details. SafePal says the wallet layer was untouched: no seed phrases, private keys, wallet passwords, payment card numbers, or government identification documents were exposed, and the company reports no evidence of unauthorized access to customer funds.

Affected customers were notified individually by email, and SafePal says it has fixed the flaw, engaged an independent security firm to verify the fix and audit its order-processing systems, cut its personal data retention window to 90 days, and taken down more than 30 phishing websites tied to the incident.

The disclosure aged badly within a day. By August 17, a threat actor on a cybercrime forum was selling a dataset advertised as the SafePal customer list, citing the same 39,798 record count and the same order window the company had published. To reassure buyers, the seller offered order IDs and shipping countries as free samples, and pointed to SafePal's own breach-verification tool (published so customers could check whether their data was affected) as the way to validate those samples before paying.

As of this writing no researcher has confirmed the listing is authentic, and recycled or padded dumps are common on these forums. But the listing's details match the disclosure precisely, and the economics are exactly what the threat model predicts: order data from a hardware wallet vendor is worth more than order data from almost any other retailer, because each record plausibly marks a person who moved money into self-custody.

The plugin that tracked the package and the tool that checks the breach both worked exactly as designed. That is what inversion looks like.

The Breach Checker Is Doing Double Duty

This series tracks protective mechanisms inverting into attack surfaces, and this incident supplies 2 clean examples. The first is the plugin itself. SafePal did not lose firmware or wallet code; it lost data through a convenience feature bolted onto its store. Order-tracking plugins are exactly the kind of component that sits outside the security perimeter a wallet vendor actually engineers.

The secure element gets audits, the firmware gets a bug bounty, and the shopping cart gets whatever the e-commerce platform's plugin marketplace shipped. Yet the plugin had standing access to the one dataset the whole security model is supposed to protect in physical space: the list of who bought a device and where they live.

An authorization flaw in a shared 3rd-party component rarely affects exactly 1 store, which is why the open question behind this breach is how many other vendors run the same code.

The 2nd inversion is smaller but telling. SafePal published a lookup tool so worried customers could check whether their records were caught in the breach. Within a day, the seller was citing that same tool as a free authenticity oracle for stolen samples. A verification endpoint answers questions for anyone holding the right identifiers; it cannot tell a victim from a prospective buyer.

To be fair to SafePal, the response has been better than most: individual notifications, an outside audit, a retention window cut to 90 days, and 30-plus phishing takedowns. The company was not careless after the fact. The lesson is narrower and more uncomfortable: even competent incident response tooling gets absorbed into the attacker's workflow the moment it goes live.

53,487 Records in a Week

SafePal is the 2nd hardware wallet vendor in a week to lose its customer map. On August 15 this series covered the leak of 13,689 home addresses from Trezor's shipping and fulfillment partner. Together the 2 incidents put 53,487 fresh records into circulation, each one linking a name to a shipping address and to the fact of a hardware wallet purchase.

The precedent for what happens next is Ledger's 2020 e-commerce database leak, roughly 270,000 physical addresses that have fueled phishing campaigns, threatening letters, and in-person visits for years afterward. The data suggests the stakes have risen since then: CertiK counted 52 physical attacks on crypto holders in the first 6 months of 2026, with home invasion displacing street robbery as the leading vector, a pattern this site documented on July 24.

The obvious counter-argument is that no coins were lost and no keys were exposed, which would make this a routine retail breach that deserves a shrug. That reading undervalues the asymmetry of the data. A firmware flaw gets patched, and the exposure window closes. A home address does not rotate.

The device you ordered in 2025 may already sit in a drawer, but the house you shipped it to still holds you, and possibly your coins. Purchase records also age into stronger signals, not weaker ones: a buyer from March 2025 who is still active in 2026 is a holder with conviction, which is exactly the profile a patient attacker filters for.

Severity here is not measured by what the attacker took from SafePal. It is measured by what the record lets someone plan.

What This Means for You

If you are one of the 39,798, assume your record is in circulation and recalibrate accordingly. Every inbound contact that references your SafePal purchase is now presumptively hostile, because the standard authenticity test (they knew my order details, so it must be real) is exactly what leaked.

SafePal will not call you, and no legitimate vendor will ever ask for a seed phrase, a wallet validation, or a transaction signed from your device. Act on your own schedule, never on an inbound prompt: unsolicited refund offers, replacement-device shipments, and security-alert emails are the attack surface now.

For everyone else, the buying pipeline is now the predictable leak point, so starve it. Ship hardware to a pickup point, PO box, or freight forwarder rather than your front door. Use a unique email alias per vendor and a secondary phone number, so a leaked record burns an identifier you can discard instead of one that follows you.

Assume at purchase time that the order record will eventually be public, and decide what you are comfortable seeing next to your name and the word bitcoin. The device protects your private keys; nothing in the checkout flow protects the buyer.

None of this argues against self-custody, and it should not push anyone back toward an exchange balance: custodial risk (freezes, withdrawal halts, platform failure) is structural, while order-data leakage is a solvable operational problem. The physical posture advice from the wrench attack coverage stands: do not discuss holdings, split keys with multi-sig or a passphrase so no single device at home can surrender everything, and have a household plan for a knock on the door that references a package you ordered 18 months ago.

Buy like someone worth robbing, because 53,487 new records now say you are.

What to Watch

Watch for independent confirmation that the forum listing is authentic, and for the dataset's absorption into phishing kits the way the Ledger dump was industrialized. Watch whether SafePal's outside audit names the plugin, because a shared e-commerce component with an authorization flaw implies other stores are exposed, and quiet copycat disclosures from other wallet vendors would confirm it.

Watch the phishing takedown count as a proxy for attacker investment. And watch the wrench attack tallies through the fall: the interval between a list leaking and doors getting knocked on has historically run weeks to months, not days.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.