SafePal Order-Tracking Plugin Flaw Exposes 40k Customer Records, Third Hardware Wallet Breach in 30 Days

The incident stems from an unauthenticated endpoint in a third-party order-tracking plugin that leaked adjacent customer order objects under specific query conditions. SafePal’s disclosure states the flaw was identified internally and patched, yet provides no IOCs, plugin name or version. This matches the pattern seen in the Trezor and Coinkite incidents last month, both involving e-commerce plugin misconfigurations rather than core wallet firmware. CertiK’s mid-2026 wrench-attack dataset records 52 verified cases through June, a 33 % YoY rise, with $124 million in losses already eclipsing the full-year 2025 total. Customer PII from all three vendors now circulates on the same dark-web forum, enabling precision targeting of high-balance holders. Hardware wallets remain cryptographically isolated, but the repeated supply-chain exposure of buyer metadata converts a privacy incident into a physical-security risk. Impacted users face immediate phishing campaigns and elevated wrench-attack probability; SafePal’s remediation notice does not address downstream data resale or secondary marketplaces. Procurement records show SafePal’s parent shifted order systems to a shared SaaS stack in late 2024, the same stack used by the prior two victims. Independent verification of plugin provenance and shared dependency mapping is absent from all three disclosures.