On August 16, SafePal, a provider of hot and cold wallets (hardware wallets), officially disclosed a security incident involving customer order data. According to the announcement, an authentication vulnerability in an order-tracking plugin allowed unauthorized access to order information belonging to other buyers.

In terms of scope, the incident affected approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The exposed data includes full names, email addresses, shipping addresses, phone numbers, and purchase details.

Crucially, the incident does not involve seed phrases, private keys, wallet passwords, banking details, or identification documents. SafePal stated that it does not collect or store this information, and its cold storage architecture operates in an environment completely isolated from its e-commerce servers. Neither user wallets nor assets were affected.

The real risk lies in targeted phishing: attackers possessing home addresses and order details could make phone calls, send emails, text messages, or physical mail impersonating SafePal personnel, luring users into installing “fake firmware” or entering seed phrases to compromise their wallets.

A controversial detail lies in the response timeline. In the FAQ section, SafePal admitted to receiving the first report in early May 2026, but treated it as an isolated incident at the time; it was not until July that the company began reviewing and rebuilding its entire order-processing pipeline and confirmed the root cause. In addition, a periodic data cleanup process had ceased operating from September 2025 to April 2026 due to a configuration error—which did not directly cause the unauthorized access, but allowed old data to persist longer than intended and explains why the affected scope stretches back to March 2025.

Regarding remediation measures, SafePal stated that it has patched the vulnerability, added an extra security layer, reduced the retention period for sensitive data to 90 days, hired an independent security firm to audit the patch, taken down more than 30 fake websites, and launched a dedicated support channel. Users can verify their status using their order ID and destination country at ‘safepal.com/scam-protection’.

Overall, this serves as a reminder that with hardware wallets, “assets are secure” is not the entire story; the supply chain and order data represent a distinct physical risk layer, and attackers with access to names, addresses, and what users purchased can execute social phishing far more sophisticated than generic scams.