No Coins Were Touched. That's Not Good News.

SafePal, the hardware-wallet maker, disclosed this month that attackers accessed order records for 39,798 customers — names, home addresses, contact details, and what they bought, TechCrunch reported. No wallets were compromised. No funds moved.

Resist the instinct to file that under "minor." A breach of a hardware-wallet vendor's order database is close to the worst-case shape for a data leak, because of what the list means: every row is a person who owns enough crypto to bother with cold storage, verified by a purchase, pinned to a street address.

What a list like this is for

The cheap use is phishing — fake "firmware update required" emails that are suddenly very convincing because the sender knows exactly which device you own and when you bought it. Coming weeks after the Coldcard exploit put every hardware-wallet owner on edge, a well-timed "check if your device is affected" lure writes itself. The expensive use is worse: physical targeting. Crypto's so-called wrench-attack problem has always depended on attackers knowing who to visit. This is that knowledge, in a spreadsheet.

The pattern, not the incident

This is the same failure mode as the 2020 Ledger leak, which fueled years of phishing and threat mail. The industry lesson never fully landed: a custody company's customer database is security-critical infrastructure, even though it never touches a key. Vendors treat the device firmware as the crown jewels and the e-commerce stack as plumbing. Attackers have noticed the plumbing.