Safepal, a wallet manufacturer headquartered in the Seychelles, is facing a security crisis involving a subset of its users.

On Sunday, the company disclosed that it had suffered an unauthorized data breach involving 39,798 customers after a plugin used for order tracking suffered a flaw that allowed unidentified actors to access this information.

The data breach involved customers’ orders between March 2, 2025, and April 11, 2026, exposing potentially critical information, including names, email addresses, shipping addresses, phone numbers, and purchase details, to the attackers.

The company ensured that seed phrase, private keys, wallet password, or other wallet credentials were not extracted during this incident.

Safepal acknowledged that the breach might lead to sophisticated phishing attempts, including “fraudulent phone calls, emails, text messages, letters, refund offers, firmware-update requests, fake customer-support communications, malicious websites, or other attempts to obtain your wallet credentials or additional personal information.”

Even so, Safepal claims it fixed the issue and implemented new security measures to prevent similar breaches, including tightening the data retention period to 90 days and taking down 30 fraudulent websites linked to scam schemes.

Nonetheless, security researcher Tay stressed that it is unlikely this dataset was used only for phishing, as shipping addresses and personal data were disclosed, suggesting a higher risk for users whose addresses were breached.

Specter, another blockchain investigator, stressed that the company had been receiving reports of phishing attempts as early as April but did not disclose it until now. Tay confirmed that several cases were reported during spring and summer that might be linked to this leak.

A customer allegedly involved in the breach pointed out that the company had deleted his data before this disclosure, criticizing Safepal’s data retention policies.

Safepal’s announcement follows similar incidents at Trezor, with Shipmonk, its shipping provider, suffering a data breach that exposed the full names, email addresses, phone numbers, and shipping addresses of 11,742 customers in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.

The wave of breaches is worrying for users involved, as cryptocurrency holders have been targeted in so-called wrench attacks, particularly in France.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。