SafePal breach exposes 40,000 customers as hardware wallet attacks escalate from data leaks to $100 million theft

SafePal has become the latest hardware-wallet provider to suffer a security incident after an authorization flaw exposed personal information from about 40,000 customers.The Aug. 16 disclosure extends a run of security problems involving hardware-wallet companies and their users, including recent incidents affecting Trezor, Ledger and Coldcard.Two SafePal failures turned an order-system flaw into a larger data exposureSafePal revealed that the breach originated in the company's e-commerce infrastructure.According to the firm, an authorization flaw in its order-tracking system allowed unauthorized access to customer records covering purchases made between March 2, 2025, and April 11, 2026. The exposed information included names, email addresses, shipping addresses, phone numbers, and purchase details.SafePal said private keys, recovery phrases, wallet passwords, payment card numbers, and wallet access were not exposed. It also found no evidence that the flaw itself was used to compromise customer wallets or steal cryptocurrency.However, the authorization weakness was only one part of the incident.A separate configuration error had prevented a scheduled cleanup process from operating...