- SafePal disclosed an authorization flaw that exposed order data of nearly 40,000 customers.
- The vulnerability affected customers who placed orders between March 2025 and April 2026.
- Leaked purchase details can support targeted phishing and impersonation attempts.
Hardware wallet security came under scrutiny after SafePal disclosed that an authorization flaw in an order-tracking plugin allowed unauthorized access to customers’ order information. The incident affected approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.
The disclosed information included names, email addresses, shipping addresses, phone numbers, and purchase details. SafePal said the incident did not involve seed phrases, private keys, wallet passwords, bank account information, payment card numbers, or government-issued identification.
SafePal Hardware Wallet Security Was Not Affected
According to SafePal’s disclosure, the issue originated in an authorization flaw within an order-tracking function connected to a plugin. Under certain conditions, the flaw allowed unauthorized access to another customer’s order information.
The company said it fixed the issue after identifying it and introduced additional security measures. SafePal also said that affected customers were notified individually by email.
The distinction between the exposed information and wallet credentials remains central to the incident. The disclosed customer records contained purchase-related information, while seed phrases, private keys, and wallet passwords were not included in the affected data.
How Leaked Ownership Data Changes the Security Picture
SafePal said the affected information could be used in targeted phishing and impersonation attempts. Its disclosure specifically listed possible approaches, including fraudulent calls, emails, text messages, letters, refund offers, firmware-update requests, and fake customer-support communications.
This creates a different security situation from an unsolicited message that contains no known information about its recipient. In this case, the disclosed order information can provide details directly related to a customer’s purchase.
The Order System Became Part of the Security Chain
The incident also highlights the systems surrounding a hardware wallet purchase. The reported flaw did not occur in the wallet’s private-key infrastructure. Instead, it affected a function used to provide customers with order information.
SafePal said it also contacted third-party logistics and fulfillment partners to investigate whether the issue had spread to their systems. The company further said it reduced the retention period for personal information in the relevant order-processing environment to 90 days, subject to applicable legal requirements.
Self-Custody Security Goes Beyond Wallet Credentials
The SafePal incident separates two categories of information related to hardware wallet ownership. The first includes seed phrases, private keys, and wallet passwords, which SafePal said were not exposed. The second includes customer and purchase information, which the incident exposed.
For the affected customers, SafePal said the incident itself did not compromise wallet access or funds. At the same time, the company advised customers to remain vigilant against phishing and impersonation attempts linked to the exposed information.
Related: 31 Security Flaws Expose 99% of x402 Crypto Payments to Theft and Fraud
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
