Bitcoin · Decrypt
SafePal joins a growing list of wallet firms whose customers have been exposed through leaks
Compiled by KHAO Editorial — aggregated from 2 sources. See llms.txt for citation guidance.
✓ KHAO Verified
The clearest cautionary tale remains Ledger, whose 2020 leak of some 272,000 customers' details led to a wave of phishing and, for some, ransom threats invoking violence.
Key facts
- Chainalysis documented 46 violent incidents in the first half of 2026 with more than $30 million stolen, calling the year on pace to be the worst on record, with home invasions increasingly
- Posted to X, SafePal said the exposed data spans customers who placed orders between March 2, 2025, and April 11, 2026, and includes names, email addresses, shipping addresses, phone numbers
- The clearest cautionary tale remains Ledger, whose 2020 leak of some 272,000 customers' details led to a wave of phishing and, for some, ransom threats invoking violence
- The timing adds to a jittery stretch for self-custody users still shaken by the Coldcard exploit, which drained long-dormant Bitcoin through a firmware entropy flaw and pushed industry-wide losses
Summary
SafePal disclosed that an order-tracking plug-in flaw gave attackers access to personal data—names, emails, shipping addresses, phone numbers and purchase details—for roughly 39,798 customers. The exposed mix of addresses and proof of crypto ownership raises the risk of physical targeting as wrench attacks surge, with Chainalysis documenting 46 violent incidents and over $30 million stolen in the first half of 2026, on pace for a record year. SafePal joins a string of wallet firms hit by leaks—Trezor's recent ShipMonk breach exposed ~13,700 customers, and Ledger's 2020 leak of ~272,000 led to ransom threats. Bitcoin and crypto wallet maker SafePal said Saturday that a flaw in an order-tracking plug-in gave attackers unauthorized access to the personal information of roughly 39,798 customers, the latest breach to put a hardware wallet company's users at risk of being physically targeted.