Cryptocurrency wallet provider SafePal has disclosed a data breach affecting nearly 40,000 customers, highlighting a persistent weakness in the digital asset industry: even after years of investment in cybersecurity and sophisticated security infrastructure, hacks, data leaks, and other breaches remain a problem that the crypto sector has struggled to eliminate.
SafePal said on Sunday that an authorization flaw in its order-tracking system allowed unauthorized users to access information belonging to other customers between March 2, 2025, and April 11, 2026.
About 39,798 customers were affected. The exposed information included names, addresses, and purchase data, according to the company.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
SafePal said the incident did not compromise seed phrases, private keys or wallet passwords. Bank account details, payment card information and government-issued identification numbers were also not exposed.
That means the breach did not give attackers direct access to the cryptocurrency stored in affected wallets. However, the stolen information can still be valuable to criminals because it provides material that can be used to build convincing phishing and impersonation attacks against crypto users.
A Different Kind of Crypto Security Threat
The SafePal incident illustrates how the security risks facing cryptocurrency users have expanded beyond attempts to directly steal private keys or drain wallets.
An attacker who knows a customer’s name, physical address, and purchase history can make a fraudulent message appear legitimate. A criminal could, for example, impersonate SafePal and claim that a customer’s hardware wallet requires an urgent security update, replacement, or verification.
The objective would ultimately be to persuade the victim to surrender information that was not compromised in the original breach, such as a seed phrase or private key, or to transfer cryptocurrency to an address controlled by the attacker.
SafePal said it had identified and removed more than 30 fraudulent websites and phishing links connected to the breach, suggesting that criminals were already attempting to exploit the exposed information. The company has fixed the authorization flaw and introduced additional security measures. It also said it will retain customers’ personal information in its order-processing system for only 90 days.
Crypto’s Security Problem Has Refused To Go Away
The incident also underscores a broader problem that has followed the cryptocurrency industry for years.
From exchanges and decentralized finance protocols to wallet providers and blockchain bridges, the crypto sector has repeatedly faced hacks, exploits, phishing campaigns, and data breaches. The technology has matured considerably, but the security problem has not disappeared.
Part of the challenge is that cryptocurrency combines valuable digital assets with infrastructure that is accessible around the clock and, in many cases, irreversible once a transaction is authorized. A successful attack can therefore have consequences that are difficult to undo.
The industry has also developed a large ecosystem of intermediaries and supporting services. A user may keep cryptocurrency in a hardware wallet but still provide personal information to a company when buying the device, registering an account, or obtaining customer support.
That creates additional points of exposure.
SafePal’s breach is particularly instructive because the attackers did not need access to the cryptographic credentials protecting users’ assets. A weakness in an ordinary order-management system was enough to expose information that could potentially be used to attack customers through other means.
The incident reinforces an important distinction in crypto security: protecting the blockchain credentials themselves is only one part of protecting digital assets.
Seed phrases and private keys remain the most critical credentials because control of them can effectively mean control of the associated cryptocurrency. But personal information can provide attackers with the starting point for social-engineering attacks designed to obtain those credentials.
That makes databases containing customer names, addresses, and transaction histories potentially valuable targets even when they do not contain private keys. For SafePal customers, the immediate danger is therefore likely to be fraudulent communications that appear to come from the company.
Data Minimization Becomes A Security Issue
SafePal’s decision to reduce the retention period for customer information to 90 days also points to a broader lesson for crypto companies.
The longer sensitive customer information remains in a database, the longer it can potentially be exposed if that database is compromised. Limiting the amount of information collected and reducing how long it is retained can reduce the potential damage from future incidents.
The change is especially relevant for companies operating in the cryptocurrency sector, where users can face both conventional identity theft and attempts to steal digital assets.
SafePal provides hardware wallets as well as mobile and browser-based tools for managing cryptocurrencies. The company has emphasized that the latest incident did not expose the credentials needed to directly access customers’ wallets.
Still, the breach shows that security failures do not have to reach the blockchain itself to create meaningful risks for crypto users.