SafePal Order Plugin Flaw Exposed 39,798 Records; Failed Cleanup Extended Window to March 2025

The exposure stemmed from an authorization bypass that let one customer view another's order data. SafePal received an initial report in early May 2026 but treated it as isolated until a July pipeline review confirmed the root cause and the separate September 2025–April 2026 data-cleanup failure. A dataset matching the exact customer count and date range later appeared for sale on a cybercrime forum.

SafePal stated no seed phrases, private keys or payment details were involved and found no evidence of wallet access. The company compared its exposure to Trezor's recent ShipMonk incident, noting Trezor's 90-day retention policy limited impact. Chainalysis documented 46 violent incidents globally through June 2026 tied to stolen crypto-holder records, with French cases rising sharply after similar tax-data leaks.

The combination of residential addresses and hardware-wallet purchases creates a ready target list for physical coercion and phishing campaigns that reference specific orders. SafePal warned customers to treat any unsolicited contact or firmware delivery as suspect. A full order-processing rebuild is underway.

Independent confirmation of the forum listing and the May–August reporting lag indicate the exposure window was wider than initially scoped and that similar plugin dependencies remain unexamined across other vendors.