SafePal order-tracking flaw exposes data of 39,798 customers

On 16 August 2026 SafePal disclosed that an authorization flaw in the order-tracking function of a plug-in let unauthorized users view other customers’ order information. It says about 39,798 customers who ordered between 2 March 2025 and 11 April 2026 were affected; exposed data includes names, email addresses, shipping addresses, phone numbers and purchase details. SafePal states that seed phrases, private keys, wallet passwords, bank and card details and government ID numbers were not involved.

According to BleepingComputer, a separate configuration error stopped a data-cleanup process from working between September 2025 and April 2026, so older order data was retained. SafePal received a first report consistent with the incident in early May 2026 and treated it as isolated; The Block reports that customers described scam contacts using their order details on Reddit and Trustpilot in early July, and that SafePal disclosed after blockchain analyst Specter raised the reports on X. SafePal began a review and rebuild of its order-processing system in July and fixed the flaw.

SafePal says it notified affected customers by email, launched a tool to check whether an order was exposed, reduced data retention to 90 days, engaged an independent firm to validate the fix and took down more than 30 fraudulent websites and phishing links. A threat actor has advertised the data on a cybercrime forum; BleepingComputer and SafePal say they could not verify the claim. SafePal’s 30 October update states that a Cure53 audit found no security vulnerabilities.

What SafePal advises:

• Never share your seed phrase, private key or password; SafePal will never ask for them.
• You do not need to move assets solely because your order information was affected.
• If you entered your seed phrase or private key in response to a suspicious message, treat the wallet as compromised and move assets to a new wallet.