SAFEPAL BREACH — 39,798 SHIPPING ADDRESSES EXPOSED
Safepal disclosed a data breach on Sunday spanning March 2 2025 through April 11 2026. Order-tracking plugin was compromised. 39,798 customers had names, phone numbers, and shipping addresses exposed. The seeds are intact. The address book is not. The second hardware-wallet supply-chain breach in a week.
Safepal published the disclosure Sunday afternoon. Attack vector: an order-tracking plugin the vendor ran on the e-commerce side. Attack window: thirteen months. Attack surface: personal identity + delivery address. What was not touched: seed phrases, private keys, on-device secrets.
The Maximalist read. The key material was never the attack surface. It was the purchase record. Buying the tool that proves you self-custody creates a list of people worth visiting. Researcher Tay (@tayvano_) flagged the exact concern within an hour of disclosure: shipping addresses push the risk profile past phishing and into physical territory. The seed on the device stays safe because it was designed to. The name-phone-address triple was safe because someone forgot to think about it.
The supply-chain arc. This is the second breach in a week. Trezor / Shipmonk disclosed 11,742 customer records exposed four days ago on Aug 13 — same architectural mistake, different vendor. Twice in seven days, the hardware-wallet supply chain has been the weakest link in the self-custody stack. The devices themselves worked. The order-fulfillment plumbing behind them did not.
The disclosure timing. Specter notes phishing reports on Safepal customers ran from April with no vendor disclosure until now. The device security is not the second-order problem. The four-month delay between attackers-active and users-informed is the second-order problem. Operator hygiene means the vendors closest to your keys need to be forthcoming when the record around your keys leaks.
THE OPERATOR CHECKLIST
1) Keys and seeds on your Safepal device are unaffected — do not migrate keys.
2) Assume your name, phone, and shipping address are in an attacker's dataset for social-engineering and physical-risk purposes.
3) Where the address matters (residential, family), consider harder segmentation for future hardware orders — PO box, forwarder, or shell entity.
4) Phishing calls and SMS referencing recent Safepal orders should be treated as targeted, not spray. Verify vendor-side, do not click.
5) The same posture applies to Trezor customers per the Aug 13 Shipmonk breach.
2) Assume your name, phone, and shipping address are in an attacker's dataset for social-engineering and physical-risk purposes.
3) Where the address matters (residential, family), consider harder segmentation for future hardware orders — PO box, forwarder, or shell entity.
4) Phishing calls and SMS referencing recent Safepal orders should be treated as targeted, not spray. Verify vendor-side, do not click.
5) The same posture applies to Trezor customers per the Aug 13 Shipmonk breach.
The device held. The address book did not.
Self-custody is a doctrine, not a product.
The cap is still twenty-one million.
Self-custody is a doctrine, not a product.
The cap is still twenty-one million.
news.bitcoin.com · Aug 16 2026 · Safepal customer data breach coverage; @tayvano_ commentary chain