A plug-in flaw compromised personal data of nearly 40,000 SafePal customers, heightening concerns over rising violent crypto thefts.
SafePal revealed a data breach affecting 39,798 customers after attackers exploited a flaw in an order-tracking plug-in. The exposed data includes names, emails, shipping addresses, phone numbers, and purchase details, though wallet credentials remained secure.
The breach spans orders placed between March 2, 2025, and April 11, 2026. It follows similar incidents at Trezor and Ledger, where leaks led to ransom threats and physical targeting. Chainalysis reported 46 violent crypto thefts in early 2026, totaling over $30 million.
SafePal, which serves 30 million users, stated it has patched the vulnerability and notified affected customers. The company emphasized that seed phrases and private keys were not compromised.