# SafePal Data Breach: Order-Tracking Plug-in Authorization Flaw Exposes 39,798 Crypto Wallet Customers' PII, Fuels Phishing Campaign

> Crypto hardware wallet vendor SafePal disclosed an authorization flaw (IDOR) in the order-tracking function of a plug-in that let customers view other customers' order records, exposing names, emails, shipping addresses, phone numbers, and purchase data for 39,798 customers who ordered between March 2, 2025 and April 11, 2026. A separate data-retention configuration error kept the records live longer than intended, a threat actor is now advertising the dataset for sale on a cybercrime forum, and the leaked contact/order details are fueling an active vishing/phishing campaign impersonating SafePal support. Wallet seed phrases, private keys, passwords, and payment data were not exposed.

- **Published:** 2026-08-16T00:00:00Z
- **Last reviewed:** 2026-08-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2032
- **ID:** TL-2026-2032
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SafePal, a Binance-backed non-custodial hardware and software cryptocurrency wallet vendor, disclosed on August 16, 2026 that an authorization flaw in the order-tracking function of a plug-in used by its order-processing system allowed any customer to view another customer's order record by manipulating the order identifier — a classic Insecure Direct Object Reference (IDOR) / broken access control failure rather than a credential compromise. A separate configuration error caused the affected records to remain in active systems well past their intended retention period, compounding the exposure between roughly September 2025 and April 2026.

SafePal states it first received a breach-consistent customer report in early May 2026 but treated it as an isolated case rather than a systemic flaw. Public complaints describing phishing contacts that referenced accurate SafePal order details surfaced on Reddit and Trustpilot on July 3-4, 2026. SafePal began a full review and rebuild of its order-processing pipeline in July 2026, during which the authorization flaw was confirmed as the root cause. The company disclosed the incident on August 16, 2026, emailing all affected customers individually from security@safepal.com and publishing a security-update advisory.

Approximately 39,798 customers who placed orders between March 2, 2025 and April 11, 2026 had their name, email address, shipping address, phone number, and purchase details exposed. SafePal states that wallet seed phrases, private keys, passwords, bank account information, payment card numbers, and government-issued identification were not exposed, and it has found no evidence that the flaw itself compromised access to any SafePal wallet or funds.

A threat actor is advertising the stolen 39,798-record dataset for sale on a cybercrime forum, offering order ID and shipping-country fields as proof of possession (not independently verified by researchers). Separately, victims report a coordinated social-engineering campaign in which callers and emailers impersonate SafePal support, cite the victim's real name, address, phone, email, and order details for credibility, and direct them to fraudulent domains such as safepal.support to request a bogus 'hardware wallet replacement' or firmware update — the classic pretext used to eventually solicit a wallet seed phrase. A second, independently-flagged typosquat domain, safepal.com.co, impersonates the official SafePal wallet service and appears in both the Phishing-Database and Solflare wallet blocklist trackers, indicating the impersonation campaign extends beyond the single domain SafePal has publicly named.

SafePal's remediation includes fixing the authorization flaw and adding access-control checks, purging personal data from active servers (retaining only encrypted offline copies for law enforcement), reducing order-processing data retention to 90 days, engaging an independent third-party security firm to validate the fix and review the broader system, taking down more than 30 fraudulent websites and phishing links, and launching an order ID + shipping-country verification tool so customers can check their exposure status. SafePal advises affected customers that they do not need to replace their wallets or move funds unless they already shared a seed phrase with a phisher, and to treat any unsolicited SafePal-branded call, DM, or email as fraudulent.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1566.004 Spearphishing Voice
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1583.001 Domains
- T1589 Gather Victim Identity Information
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1657 Financial Theft

## Sources

- [SafePal data breach impacts 39,798 customers, stolen info for sale](https://www.bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale/)
- [Unauthorized Access To A Subset Of Customer Order Information](https://www.safepal.com/en/blog/security-update)
- [SafePal Scam Protection / Order Verification Tool](https://www.safepal.com/en/scam-protection)
- [Wallet provider SafePal says data breach exposed personal info of nearly 40,000 customers](https://www.theblock.co/news/business/2026-08-16-wallet-provider-safepal-says-data-breach-exposed-personal-info-of-nearly-40000-customers-411934)
- [Safepal security vulnerability exposes data of 39,798 customers](https://www.coindesk.com/tech/2026/08/16/crypto-wallet-safepal-reveals-a-data-breach-exposing-nearly-40-000-customers-order-info)
- [Breach at Crypto Wallet Company Called 'SafePal' Exposes 39,798 Customers](https://gizmodo.com/breach-at-crypto-wallet-company-called-safepal-exposes-39798-customers-2000799138)
- [Binance-Backed SafePal Reveals Data Breach: 40,000 Users' Info Exposed](https://www.tradingview.com/news/u_today:dd69639b5094b:0-binance-backed-safepal-reveals-data-breach-40-000-users-info-exposed/)
- [Binance-Backed SafePal Data Leak Sparks Phishing Fears for 40K Buyers](https://www.cryptotimes.io/2026/08/16/binance-backed-safepal-data-leak-sparks-phishing-fears-for-40k-buyers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2032