SafePal has become the latest hardware-wallet provider to suffer a security incident after an authorization flaw exposed personal information from about 40,000 customers.
The Aug. 16 disclosure extends a run of security problems involving hardware-wallet companies and their users, including recent incidents affecting Trezor, Ledger and Coldcard.
Two SafePal failures turned an order-system flaw into a larger data exposure
SafePal revealed that the breach originated in the company’s e-commerce infrastructure.
According to the firm, an authorization flaw in its order-tracking system allowed unauthorized access to customer records covering purchases made between March 2, 2025, and April 11, 2026. The exposed information included names, email addresses, shipping addresses, phone numbers, and purchase details.
SafePal said private keys, recovery phrases, wallet passwords, payment card numbers, and wallet access were not exposed. It also found no evidence that the flaw itself was used to compromise customer wallets or steal cryptocurrency.
However, the authorization weakness was only one part of the incident.
A separate configuration error had prevented a scheduled cleanup process from operating correctly between September 2025 and April 2026, leaving older order records in the system for longer than intended.
That failure expanded the pool of information available through the authorization flaw and extended the affected dataset back to March 2025.
The retention failure also conflicts with a SafePal support statement published in 2020, which said information associated with delivered hardware-wallet orders would be retained for 30 days and then destroyed through a monthly cleanup process.
Together, the two failures explain both how customer information became accessible and why nearly 40,000 records remained available: one control failed to restrict access, while another failed to delete information that should no longer have been stored.
Hardware-wallet incidents spread from data leaks to nine-figure theft
SafePal’s disclosure is the latest in a series of security incidents involving major hardware-wallet providers and their customers this year.
In recent weeks, Trezor disclosed that a breach at its shipping provider exposed personal information belonging to nearly 14,000 customers, while Coldcard users suffered direct losses after a flaw in the wallet’s key-generation process allowed attackers to drain Bitcoin from affected addresses. Ledger customers were also affected by an order-data breach involving third-party payment provider Global-e earlier this year.
The Coldcard incident has produced the largest financial loss among the recent cases. More than $100 million in Bitcoin was stolen after a bug left some private keys insufficiently secure, and funds were drained across multiple attack waves beginning in late July.
The other incidents have primarily exposed customer information rather than private keys, but security experts have warned that the stolen data creates another route for criminals to target crypto holders.
Binance co-founder Changpeng Zhao pointed out that the breaches exposing names, phone numbers, emails and delivery addresses could increase phishing, social-engineering and physical-security risks.
Notably, SafePal issued a similar warning after its own breach and said it had already taken down more than 30 fraudulent websites and phishing links targeting customers.
Meanwhile, including home addresses raises a more serious physical-security concern because leaked customer records can identify people who purchased devices commonly used to store cryptocurrency.
That comes as violent attacks against crypto holders are already increasing. Chainalysis said so-called wrench attacks, including kidnappings and home invasions used to force victims to transfer digital assets, resulted in about $30 million of reported thefts during the first half of 2026. The total for 2025 reached a record $58 million.
Chainalysis data also showed that home invasions accounted for 37% of violent crypto attacks recorded in 2026, while kidnappings made up more than half of reported incidents tracked this year.
The recent hardware-wallet incidents have therefore produced risks at several levels. Coldcard users have already suffered more than $100 million in direct Bitcoin theft, while breaches affecting SafePal, Trezor and Ledger have exposed information that can be used for targeted phishing, impersonation and potentially physical attacks.
Taken together, the incidents complicate the idea of hardware wallets as a single line of defense. The devices may protect private keys, but users remain exposed to firmware failures, customer databases, and the broader infrastructure surrounding self-custody.
