Hardware Wallet Data Breach: SafePal and Trezor Leaks

On August 16 SafePal disclosed that outsiders had obtained data on 39,798 buyers. Three days earlier Trezor said the same thing: a compromise at its logistics partner ShipMonk exposed data on almost 14,000 people. Two companies, one week, the same class of data: two hardware wallet data breaches back to back.

What actually leaked

Names, phone numbers, email addresses, order contents and delivery addresses. Seed phrases, private keys, passwords and banking details were untouched: SafePal simply does not collect them, and the team found no sign that funds or wallets were accessed.

The cause at SafePal is technical and unflattering. An authorisation flaw in an order-tracking plugin let one customer see another customer's orders. Orders placed between March 2, 2025 and April 11, 2026 were affected. The hole has been closed, the retention period in that system has been cut to 90 days, and logistics partners were asked to check their own systems and notify clients.

Why this is worse than it looks

The keys were not stolen, so the funds are safe. That is the reassuring half.

The other half is worse. A leaked contact database does not hit the vault, it hits the owner: it is now known who keeps a hardware wallet, at which address they live, and which inbox to write to.

From there the work becomes targeted. Criminals call and write in the name of customer support, offer to release supposedly stuck funds, demand an urgent firmware update or push the victim toward a spoofed site. The recipient sees a message that correctly names their device model and purchase date, and believes it. The user usually does not know about the incident yet: the official notification arrives later than the scammer's email.

The precedent everyone remembers

In 2020 the same story played out at Ledger, when data on roughly 272,000 customers ended up online. Some of them received ransom demands with threats of violence, followed by calls from people who spoke as though they knew them personally. In January of this year the same company had another leak, this time at an e-commerce partner.

The conclusion from both cases is identical: customer databases outlive the incidents, and ordinary users pay for it. The story does not end with a press release. It spreads in copies and resurfaces a year later, sometimes three.

How to spot a fake now

Support never asks a customer for a seed phrase. Not the whole thing, not a single word, not for verification purposes. Any message that does can be closed unread.

Firmware is installed only from the official application, never from a link in an email. The link itself is not opened at all: the address is typed by hand or taken from bookmarks.

Refunds issued by the vendor do not exist as a procedure. An offer to compensate your losses is a reliable sign that you are not talking to the manufacturer.

What to do after a hardware wallet data breach

Check whether your data appears in public breach databases: the mailbox used for the order is what links your identity to the purchase of a device.

After any leak like this it is worth changing delivery habits. A pickup point instead of your apartment, neutral packaging, and the device box kept out of the household rubbish.

Trezor is accelerating the launch of anonymous delivery, and that is the right answer to breaches of this kind: not storing surplus data is more reliable than promising to guard it well. Asking a seller how long they keep records about you is worth doing before the purchase, not after the next incident. The answer should be a specific number, and a decent manufacturer will give one.

Neither of these leaks involved breaking cryptography. Both come down to the same thing: the customer list turned out to be worth more than the devices. The owner's keys are protected by cryptography, their personal data by somebody else's plugin.

Key Takeaways

• On August 16 SafePal disclosed that outsiders had obtained data on 39,798 buyers.
• Names, phone numbers, email addresses, order contents and delivery addresses.
• The cause at SafePal is technical and unflattering.
• The keys were not stolen, so the funds are safe.
• From there the work becomes targeted.