Home›Crypto›Market Structure›SafePal flaw exposed about 40,000 customers via order-…

SafePal flaw exposed about 40,000 customers via order-tracking access

The authorization flaw covered purchases from March 2, 2025 through April 11, 2026, while a cleanup failure left older order records in the system longer than intended.

Reported · Written up by our desk · Market Structure

SafePal disclosed a security incident in which an authorization flaw in its order-tracking system exposed personal information for about 40,000 customers. The company said the exposed data related to purchases made between March 2, 2025 and April 11, 2026, and included customers names, email addresses, shipping addresses, phone numbers, and purchase details.

SafePal said the incident did not expose private keys, recovery phrases, wallet passwords, payment card numbers, or wallet access. The firm also said there was no evidence the flaw was used to compromise customer wallets or steal cryptocurrency.

The disclosure cited a separate configuration error that prevented a scheduled cleanup process from running correctly between September 2025 and April 2026, leaving older order records available for longer than intended. The company said that retention failure expanded the affected dataset back to March 2025 and, together with the access control failure, explained why nearly 40,000 records remained accessible.

SafePal said the incident follows a broader run of hardware-wallet security problems this year, including disclosures involving Trezor, Coldcard, and Ledger. CryptoSlate also noted that Coldcard reported direct losses after attackers exploited a key-generation flaw, with more than $100 million in Bitcoin stolen in that case.

Latest closeBitcoin $63,324.38 ▲0.8%

More like this

Sources