In a statement, the wallet provider said information belonging to customers who placed orders between March 2, 2025, and April 11, 2026, was accessed externally without authorization due to a security flaw.

“We are extremely sorry to inform the community that order information for customers who placed orders between March 2, 2025 and April 11, 2026... was accessed externally without authorization due to the flaw,” SafePal said.

The compromised information includes customers’ names, email addresses, shipping addresses, phone numbers and purchase details.

According to SafePal, approximately 39,798 customers were affected by the incident.

“All affected customers have been notified individually by email from security@safepal.com at Aug 16th with the email subject [Important] Your SafePal Order Information Has Been Affected,” the company said.

SafePal stressed that the breach did not involve customers’ seed phrases, private keys, wallet passwords or other wallet credentials. It also said that bank account information, payment card numbers and government-issued identification documents were not affected.

“SafePal never requests, collects, processes or stores such information from customers. No evidence has been found that the incident itself compromised access to

SafePal wallets or funds,” the company said.

SafePal's Recommendations to Customers

SafePal urged affected users to remain vigilant and follow several precautions to protect themselves from potential scams and phishing attempts.

• Never share your seed phrase, private key or password with anyone, including anyone claiming to be a SafePal support representative. The company said it will never request such information by phone, email or through any other channel.
• Do not click links or scan QR codes contained in unsolicited emails, text messages or letters claiming to be from SafePal. Users who receive suspicious emails should report them to their email provider.
• Type SafePal's website address manually into a browser instead of following links in emails or other messages. SafePal also warned users about fraudulent websites that may attempt to mimic its domain by replacing the lowercase letter “l” with an uppercase “I”.
• Stay alert for suspicious communications or impersonation attempts. Users should treat any unexpected phone calls, letters, packages or hardware deliveries related to their SafePal purchases with caution.
• Report suspicious activity including messages, calls, letters or websites through SafePal's dedicated reporting webpage. The company advised users not to contact it through social media for privacy reasons.

SafePal said there is currently no evidence that the incident compromised access to customers’ cryptocurrency wallets or funds, but warned users to remain cautious about potential phishing and impersonation attempts following the data exposure.