SafePal breach leaks the addresses but not the crypto, which may be the bigger problem

SafePal, the Binance-backed maker of hardware and software crypto wallets, has disclosed a data breach affecting roughly 39,798 customers, all of whom placed orders between 2 March 2025 and 11 April 2026.

The exposed records cover order information, namely names, physical addresses and contact details. It is the kind of leak that feels almost quaint next to the year’s bigger heists, such as when ShinyHunters dumped 45GB of Madison Square Garden data, until you consider who the customers are.

First, the reassuring part. SafePal is adamant that no cryptocurrency funds were touched, and that passwords, private keys, seed phrases, bank details, payment-card numbers and government-issued IDs all stayed out of reach.

Wallet security held, and users’ digital assets were never compromised. For a company whose entire pitch is safekeeping, that distinction matters enormously, and it is the line the firm will be keenest to repeat.

The cause was mundane, as these things usually are. SafePal blames an “authorization flaw” in a third-party plug-in used for order tracking, which let attackers view other customers’ order details simply by manipulating order numbers.

It is a textbook insecure-direct-object-reference bug, the sort of thing that should be caught in a first-year security review, sitting quietly in a bolt-on tool.

SafePal says it patched the flaw immediately and has since emailed affected users from [email protected].

It also hired an independent third-party auditor, cut its data retention window to 90 days, identified and removed more than 30 fraudulent websites and phishing links, and gave customers a tool to check whether their own details were caught up in the leak.

As breach responses go, it is a tidy list, and notably brisker than the corporate throat-clearing these disclosures usually involve.

Here is the awkward truth, though. This is a crypto breach that spared the crypto and leaked the addresses, and for this particular customer base that may well be the more dangerous loss. A stranger cannot drain your wallet with your postal address, but they can do a great deal else with it.

The immediate risk is the familiar one. Anyone holding names and contact details for nearly 40,000 self-identified crypto owners has a ready-made list for targeted phishing and impersonation, and the emails will look convincing precisely because the sender knows what you bought and where it was shipped.

That is the same social-engineering economy that keeps outfits like the crew behind Ryuk ransomware, which earned its operators $3.7M in Bitcoin, in business.

The less familiar risk is physical, and it is uglier. For people known to hold cryptocurrency, a leaked name paired with a home address raises the spectre of the so-called “wrench attack”, the grim shorthand for coercing someone into handing over their keys in person.

Because crypto transactions are irreversible and hard to trace, the incentive to simply turn up at the door is real. Reports of crypto holders being targeted, robbed and worse have climbed steadily, and a tidy list of confirmed owners with delivery addresses is exactly the wrong thing to lose.

The other lesson is wearily predictable. The weak link was not SafePal’s vault but a third-party plug-in bolted onto its shop, a pattern that has become the defining shape of modern data leaks. It is the same story that recently caught out cosmetics giant Estée Lauder through an Oracle E-Business flaw: the core system holds, the accessory does not.

SafePal deserves some credit for a brisk and unusually candid response, and for building a product where a breach of the storefront left the wallets untouched. Yet the episode is a reminder that in crypto, privacy is not a soft feature bolted on beside security. For a customer whose name and address are now circulating on the open market, and who cannot patch, rotate or reissue where they live, it is the security.