SafePal Wallet Data Breach Exposes Purchase Details of 39,798 Users

SafePal, the hardware wallet maker, said in an official statement today, Monday, 26 Mordad 1405 (August 17, 2026), that a security flaw had exposed the personal information of nearly 39,798 users. According to ArzDigital, the flaw stemmed from an authentication error in one of its order tracking plugins and exposed users' names, emails, mailing addresses, phone numbers and purchase details from March 2025 to April 2026.

SafePal stressed that sensitive data such as recovery phrases, private keys, wallet passwords and bank account details were not exposed and that user assets remain fully secure. The company said the flaw has now been fixed, it has cut its personal data retention period to 90 days, and it has identified and blocked more than 30 phishing websites and links tied to the incident. SafePal warned users to never enter their recovery phrase on any website, since the company will never request one.