The breach has impacted 39,798 customers who placed orders between March 2, 2025 and April 11, 2026.
SafePal stressed that the core security of its wallets remains intact, adding that users’ seed phrases, private keys, bank passwords, bank account information, payment card numbers, and government-issued IDs were not affected.
However, SafePal said users who have shared their private keys or seed phrases via a phishing email, phone call, or letter should treat their wallet as compromised and transfer their assets to a new wallet.
How SafePal is responding
The company said it had patched the vulnerability and introduced additional security measures in response. SafePal notified all affected customers by email from security@safepal.com on Sunday and hired an independent third-party security firm to audit the fix and review its order-processing systems.
SafePal also said it would retain customers’ personal data in its order-processing system for only 90 days from the date of collection. In addition, the company identified and removed more than 30 fraudulent websites and phishing links associated with the breach.
Customers can use a verification tool on SafePal’s website to check whether their data was affected, the company said.