SafePal confirms 39,798-customer data breach as hardware-wallet attacks widen

SafePal names authorization flaw as the exposure vector

SafePal told customers that an authorization flaw in an order-tracking plug-in surfaced customer order records, including names, email addresses, shipping addresses, phone numbers and purchase details, for 39,798 accounts. The company said there was no evidence that seed phrases, private keys or payment card data were affected, and notified affected users by email on August 16 from [email protected]. Affected orders were placed between March 2, 2025 and April 11, 2026, a window of more than thirteen months of transactions. SafePal flagged phishing, refund scams and fake support contacts as the realistic downstream risk tied to the exposed details.

Three hardware-wallet vendors hit in a month through shipping and partner links

SafePal became the third hardware-wallet maker affected in roughly a month after Trezor and Coinkite separately dealt with security issues that exposed information for thousands of their customers. Reporting described breaches at two shipping companies as the mechanism that put crypto owners who hold physical hardware wallets at greater risk of having their funds stolen, with separate vendor disclosures tracing back to logistics partners rather than the wallets themselves. The pattern points to weaknesses in the broader tech ecosystem that crypto hardware depends on, where customer identity data sits with third parties that handle fulfilment, tracking and notification.

Shipping-address leaks translate directly into physical "wrench attack" risk

A separate write-up framed the cascade as shipping leaks fueling wrench attacks, in which criminals use a victim's home address to coerce surrender of wallet credentials. The chain runs from breach at a shipping vendor, to exposed name plus address plus phone number, to in-person targeting of the holder of a hardware device. Because the leaked fields are precisely the ones a courier or fulfilment partner would normally hold, mitigations have to be applied at the authorization boundary rather than at the device itself, and customers are advised to expect social-engineering attempts that lean on real order details.

BitBox ships wallet patches against malicious-firmware installation paths

On the device side, BitBox issued patches for flaws that could allow installation of malicious firmware, closing a different class of risk that targets the wallet itself rather than the customer's identity. Where the SafePal and shipping-vendor incidents leak PII that enables coercion, a firmware-install flaw can subfiltrate the secure element and accept attacker-controlled code during an update. The contrast is useful for practitioners: identity-layer incidents need rotation of contact details, mailbox hygiene and address confidentiality, while device-layer incidents need verified firmware channels and reproducible update builds.

What practitioners should check by end of week

Review any integration that authorizes access to order, shipping or tracking data and confirm that authorization checks happen on the server side rather than in client-side plug-ins, which is the class of flaw SafePal named. Audit shipping and logistics partners for breach notifications and require vendors to attest to the integrity of PII they hold for your customers. For device-side hygiene, verify update signatures and firmware provenance against published checksums, and keep a written runbook for users who suspect their address has been exposed in any of the three vendor incidents.

Tell customers to expect targeted phishing that uses real order details and to verify any "support" contact through a second channel before acting.