Security · Breach
No Coins Were Touched. That's Not Good News.
The SafePal breach exposed names, home addresses, and order records for 39,798 hardware-wallet buyers. Nothing was stolen — because the list itself is the loot.
Correction, Aug 30, 2026: This story originally credited TechCrunch (Aug 17) as first to report the breach. CoinDesk published on Aug 16, the same day SafePal notified affected customers. The receipt above has been corrected to credit the disclosure and both outlets.
SafePal, the hardware-wallet maker, disclosed this month that attackers accessed order records for 39,798 customers — names, home addresses, contact details, and what they bought. No wallets were compromised. No funds moved.
Resist the instinct to file that under "minor." A breach of a hardware-wallet vendor's order database is close to the worst-case shape for a data leak, because of what the list means: every row is a person who owns enough crypto to bother with cold storage, verified by a purchase, pinned to a street address.
How the list got out
The mechanism was mundane, which is the point. SafePal traced the exposure to an authorization flaw in a plug-in used to track customer orders — a bolt-on to the storefront, not the wallet, not the firmware, per BleepingComputer's account. Anyone who worked out the pattern could pull order records that were never meant to be theirs.
The second failure is the one that decided how bad this got. A separate configuration error meant order data was not being cleaned up as intended between September 2025 and April 2026, so records that should have aged out were still sitting there to be taken. The exposed set covers orders placed from Mar 2, 2025 through Apr 11, 2026. A working retention policy would not have prevented the breach; it would have made it a fraction of the size.
The timeline is the uncomfortable part. SafePal received the first customer reports in early May 2026 and treated them as isolated cases, escalating to a formal investigation only in July, when the flaw was identified. Customers were notified on Aug 16, under the subject line "[Important] Your SafePal Order Information Has Been Affected." That is roughly three months between the first signal and the first warning to the people on the list.
Three months from first report to first warning
| When | What happened |
|---|---|
| Sep 2025 – Apr 2026 | Config error leaves old order data in place instead of purging it |
| Early May 2026 | First customer reports arrive; treated as isolated incidents |
| July 2026 | Formal investigation opens; authorization flaw in the order-tracking plug-in identified |
| Aug 16, 2026 | 39,798 customers notified by email; CoinDesk reports |
| Aug 2026 | Records advertised for sale on a cybercrime forum |
SafePal has been specific about what did not leak, and the list is worth repeating because it is the difference between a bad week and a catastrophe: no seed phrases, no private keys, no passwords, no bank details, no card numbers, no government ID numbers. The company says it has found no evidence that the incident gave anyone access to wallets or funds. On the response side it has taken down more than 30 fraudulent websites and phishing links tied to the breach, and published a tool letting customers check whether they were affected.
The list is already for sale
Whatever comfort there is in "no keys were taken" is undercut by where the data went next. An actor on a cybercrime forum has advertised roughly 39,798 customer records, offering order IDs and shipping countries as proof the goods are real. BleepingComputer noted it could not independently verify that the seller actually holds the data — a caveat that matters, since claiming to hold a breach you read about is a standard forum grift.
Assume it is genuine anyway. That is the only planning posture that makes sense for anyone on the list, and the cost of being wrong in that direction is a few discarded emails.
What a list like this is for
The cheap use is phishing — fake "firmware update required" emails that are suddenly very convincing because the sender knows exactly which device you own and when you bought it. Coming weeks after the Coldcard exploit put every hardware-wallet owner on edge, a well-timed "check if your device is affected" lure writes itself. The expensive use is worse: physical targeting. Crypto's so-called wrench-attack problem has always depended on attackers knowing who to visit. This is that knowledge, in a spreadsheet.
The pattern, not the incident
This is the same failure mode as the 2020 Ledger leak, which fueled years of phishing and threat mail. The industry lesson never fully landed: a custody company's customer database is security-critical infrastructure, even though it never touches a key. Vendors treat the device firmware as the crown jewels and the e-commerce stack as plumbing. Attackers have noticed the plumbing.
Update: SafePal was the first of five
When this story ran on August 27, the SafePal breach looked like a bad month for one vendor. Three weeks later it reads as the opening entry in a cluster. Trezor disclosed on August 13 that a fulfilment contractor had been breached through a maximum-severity flaw in Metabase, a business-intelligence tool no Trezor customer ever chose, exposing 13,689 buyers — the damage capped only by a 90-day deletion policy that had quietly done its job. On August 17, Israel's largest regulated broker, Bits of Gold, disclosed a breach reached through the same Metabase flaw at an analytics provider, affecting somewhere between 200,000 and 250,000 customers depending on which outlet you read. And in September, the Swiss non-custodial broker Pocket Bitcoin put its own support-desk breach at 5,411 people.
Five disclosures, at least three unrelated root causes, one shared shape: none of them touched a key, and every one of them was announced with some version of the sentence "customer funds were not affected."
The data got worse, not just more plentiful
The more useful way to read the cluster is by escalation rather than volume. What a leaked SafePal row proves is that a named person at a known address owns a hardware wallet. That is enough for convincing phishing and, as this story argued in August, enough for physical targeting. What leaked at Bits of Gold and Pocket Bitcoin is a category worse: both sets paired customer identities with public wallet addresses.
One month, five disclosures, an escalating data class
| Company | People | Identity + address | On-chain address too? |
|---|---|---|---|
| Trezor (via 3PL) | 13,689 | Yes | Not reported |
| SafePal | 39,798 | Yes | Not reported |
| Bits of Gold | 200k–250k | Yes, plus national ID | Yes |
| Pocket Bitcoin | 5,411 (291 in the worst tier) | Yes, plus ID documents | Yes |
The distinction is not academic. A leak that says you own a wallet tells an attacker you are worth approaching. A leak that hands over your on-chain address tells them what you are worth — the balance and the entire transaction history are public, permanently, to anyone holding the link. And that link cannot be revoked the way a password or an account number can. It is the one field in these dossiers that stays true forever.
The Take
If you're on this list, assume the mail is hostile: no legitimate vendor will ever ask you to "validate" a seed phrase, and firmware updates happen through the official app, never a link. More broadly — buy hardware wallets with a PO box and an email alias. The device protects your keys; nothing about the purchase protects you.