Hardware wallet company SafePal this time leaked order information, not wallets. On August 16, the company disclosed that among customers who placed orders between March 2, 2025 and April 11, 2026, 39,798 people’s names, email addresses, shipping addresses, phone numbers, and purchase details were accessed without authorization.
The company stated that recovery phrases, private keys, funds, bank cards, and ID numbers were not within this scope. The vulnerability was in the authorization for the order-query plugin; it has already been fixed, and more than 30 phishing sites were taken down.
The company stated that recovery phrases, private keys, funds, bank cards, and ID numbers were not within this scope. The vulnerability was in the authorization for the order-query plugin; it has already been fixed, and more than 30 phishing sites were taken down.