SafePal Bitcoin Wallet Data Breach Stokes Fears of Physical Attacks

Bitcoin and crypto wallet maker SafePal said Saturday that a flaw in an order-tracking plug-in gave attackers unauthorized access to the personal information of roughly 39,798 customers, the latest breach to put a hardware wallet company’s users at risk of being physically targeted.

In a statement posted to X, SafePal said the exposed data spans customers who placed orders between March 2, 2025, and April 11, 2026, and includes names, email addresses, shipping addresses, phone numbers, and purchase details.

The company stressed that wallet credentials themselves were untouched, saying seed phrases, private keys, wallet passwords, bank details, payment card numbers and government IDs were not involved. SafePal, a non-custodial wallet suite backed by Binance and Animoca Brands that says it serves 30 million users, said it has fixed the issue, notified affected customers by email, and set up a page to check exposure.

While no funds were directly stolen, the mix of names, home addresses, and evidence of crypto ownership is precisely the kind of data that can steer criminals toward high-net-worth holders. That concern has sharpened alongside a rise in so-called wrench attacks, in which victims are threatened or assaulted until they surrender their crypto.

Chainalysis documented 46 violent incidents in the first half of 2026 with more than $30 million stolen, calling the year on pace to be the worst on record, with home invasions increasingly overtaking kidnappings.

SafePal joins a growing list of wallet firms whose customers have been exposed through leaks. Just days earlier, hardware wallet maker Trezor disclosed that a breach at shipping partner ShipMonk compromised data on roughly 13,700 customers. The clearest cautionary tale remains Ledger, whose 2020 leak of some 272,000 customers’ details led to a wave of phishing and, for some, ransom threats invoking violence.

The timing adds to a jittery stretch for self-custody users still shaken by the Coldcard exploit, which drained long-dormant Bitcoin through a firmware entropy flaw and pushed industry-wide losses toward $130 million.

SafePal apologized to its community and said it would post updates on its blog as its investigation continues.