SafePal discloses a data breach affecting 39,798 customers

Binance-backed hardware wallet maker SafePal disclosed a data breach exposing personal information belonging to 39,798 customers who made purchases between 2 March 2025 and 11 April 2026. The company traced the exposure to an authorisation flaw in a third-party order-tracking plug-in used on its store, which let unauthorised parties access customer names, email addresses, phone numbers, shipping addresses and purchase details. SafePal said no seed phrases, private keys, wallet passwords or other wallet credentials were exposed.

The disclosure came four days after rival hardware wallet maker Trezor reported a separate breach, traced to its shipping provider ShipMonk, which had been targeted by the ShinyHunters group through a SQL injection attack. That incident exposed order information for 13,689 customers across the US, UK, Sweden, Colombia, Brazil, Italy and Portugal.

Two hardware wallet breaches inside a week, both originating in third-party order-management systems rather than the wallets' own firmware, points to the supply chain around custody hardware as the weaker link.