SafePal Data Breach Exposes 40,000 Crypto Wallet Customers

Executive Summary

On August 16, 2026, cryptocurrency hardware wallet maker SafePal disclosed a data breach that exposed the personal and order information of 39,798 customers. The breach resulted from a Broken Object Level Authorization (BOLA/IDOR) vulnerability in a third-party order-tracking plugin on its e-commerce site. The exposed data, which includes full names, email addresses, phone numbers, and physical shipping addresses, is now reportedly being sold on a cybercrime forum. While the core security of the hardware wallets and customer crypto assets remains unaffected, the leaked data places victims at high risk for sophisticated phishing, vishing, and impersonation attacks. SafePal has since patched the vulnerability, notified affected users, and implemented a shorter data retention policy.

Threat Overview

The security incident stemmed from an authorization flaw within a third-party plugin used on SafePal's e-commerce website for tracking customer orders. This vulnerability, identified as a Broken Object Level Authorization (BOLA), also known as an Insecure Direct Object Reference (IDOR), allowed an unauthorized external party to systematically access and exfiltrate the order information of other customers. The data exposure affects orders placed over a thirteen-month period, from March 2, 2025, to April 11, 2026.

The threat actor who exploited this flaw successfully scraped the data of 39,798 customers. Following the breach, the stolen dataset was listed for sale on a cybercrime forum, with the seller's claims matching the number of victims and the specific order date window confirmed by SafePal. This indicates a clear financial motive behind the attack, with the data being monetized by selling it to other malicious actors.

Technical Analysis

The attack vector was a classic API security failure. BOLA/IDOR vulnerabilities, categorized by OWASP as the top API security risk (API1:2023), occur when an application fails to properly validate that a user is authorized to access a specific data object. In this case, the attacker was likely able to manipulate an identifier in an API request (e.g., an order ID or user ID) to cycle through and retrieve data belonging to other users. The third-party nature of the plugin highlights the risks associated with supply chain dependencies in web applications.

MITRE ATT&CK Techniques

• T1190 - Exploit Public-Facing Application: The attacker exploited a vulnerability in the web-facing e-commerce plugin to gain unauthorized access to data.
• T1598.002 - Spearphishing Link: The stolen PII is highly suitable for follow-on spearphishing campaigns, which have already been reported by at least one customer.
• T1589.002 - Email Addresses: The attackers specifically gathered email addresses as part of their data acquisition phase to enable future attacks.
• T1583.006 - Web Services: The threat actor is using a cybercrime forum (a web service) to advertise and sell the stolen data.

Impact Assessment

While SafePal correctly emphasizes that cryptographic assets were not directly at risk, the business and customer impact is severe. The compromised data includes full names, email addresses, phone numbers, and physical shipping addresses. For owners of cryptocurrency hardware wallets, who are often high-value targets, this information is a goldmine for criminals.

• Targeted Attacks: Attackers can use the data to craft highly convincing phishing emails or vishing calls. For example, an email could reference the victim's name, recent order, and shipping address to trick them into revealing their wallet's seed phrase under the guise of a security alert or support issue.
• Physical Threats: The exposure of physical addresses raises the possibility of physical threats, including extortion or home-invasion robberies, a known risk for high-profile crypto holders.
• Reputational Damage: The breach damages SafePal's reputation, even though the core product was not compromised. It erodes customer trust in the company's ability to protect their personal data.
• Regulatory Scrutiny: The incident could attract scrutiny from data protection authorities under regulations like GDPR, potentially leading to fines.

IOCs — Directly from Articles

No specific technical indicators of compromise (such as IP addresses, domains, or file hashes) were mentioned in the source articles.

Cyber Observables — Hunting Hints

The following patterns could indicate related malicious activity targeting affected SafePal customers:

• Email Subject Lines: Security teams and individuals should be wary of emails with subjects like "Urgent: Secure Your SafePal Wallet," "Action Required: SafePal Order Confirmation Issue," or "Your SafePal Assets Are At Risk."
• Sender Domains: Monitor for emails from domains that typosquat safepal.com, such as safepal-support.io, secure-safepal.net, or similar variations.
• Suspicious Links: Scrutinize any links in emails that purport to be from SafePal. Attackers will likely use URLs that lead to credential harvesting pages designed to look like the official SafePal site.
• SMS/Vishing: Be alert for unsolicited SMS messages or phone calls claiming to be from SafePal support, especially if they create a sense of urgency and ask for a seed phrase or password. SafePal has stated they will never ask for this information.

Detection & Response

• Customer Awareness: Affected individuals should be instructed to treat any unsolicited communication from "SafePal" with extreme suspicion. The most critical point is to never, under any circumstances, enter their seed phrase into a website or share it with anyone.
• Email Filtering: Enterprise security teams can implement email gateway rules to block or quarantine messages containing suspicious keywords and originating from newly registered domains.
• Phishing Site Takedown: SafePal is already engaged in taking down phishing sites. Organizations can contribute by reporting look-alike domains to registrars and hosting providers.
• D3FEND Techniques: Implement URL Analysis (D3-UA) and Sender Reputation Analysis at the email gateway to detect and block incoming phishing attempts.

Mitigation

• Vendor Security Assessment: Organizations must rigorously vet third-party plugins and software. This includes static/dynamic application security testing (SAST/DAST) and reviewing the vendor's security practices before integration.
• Data Minimization: SafePal's move to a 90-day data retention policy is a positive step. All organizations should regularly review and minimize the customer data they store, keeping only what is essential for business operations.
• API Security: Implement robust API security controls, including strict authorization checks on every request to prevent BOLA/IDOR flaws. Use tools to automatically test APIs for such vulnerabilities.
• Customer Education: Continuously educate customers about common phishing tactics and the critical importance of safeguarding their seed phrases.
• D3FEND Countermeasures: Employ Application Configuration Hardening (D3-ACH) to ensure third-party components are securely configured and User Training as a critical defense layer against social engineering.