SafePal Breach Leaks 39,798 Customer Records via Order Plugin Flaw

The breach stemmed from a bug that retained order data far longer than designed, allowing initial access after a May report that SafePal first dismissed as isolated. A July pipeline rebuild confirmed the flaw. The firm patched the plugin, reduced retention periods, hired external investigators, and removed over 30 phishing domains tied to the leak while tracing on-chain movements for affected users reporting losses.

Forum posts by the actor advertising exactly 39,798 records align with SafePal's numbers, confirming the dataset's authenticity. This mirrors the Trezor-ShipMonk incident where logistics plugins served as vectors, a recurring pattern in hardware wallet supply chains where e-commerce integrations receive less scrutiny than wallet firmware.

Official statements stress no seed phrases or keys were taken, yet the disclosure timing with the data sale indicates possible undetected dwell time. Absence of a public CVE or exploit details limits independent verification of the plugin's specific weakness.

Users face targeted phishing campaigns using the leaked contact data; SafePal advises immediate wallet rotation if any credentials were shared. Expect increased regulatory focus on crypto order systems and third-party plugin audits within the next quarter.