SafePal account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through SafePal’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
SafePal order records are for sale, and your seed phrase is not in them
SafePal said on 16 August 2026 that an authorization flaw in the order-tracking function of a plug-in let one customer's order information be pulled up by someone else, and that roughly 39,798 people who ordered between 2 March 2025 and 11 April 2026 are affected. Exposed: name, email address, phone number, shipping address and purchase details. Not exposed, in the company's own list: seed phrase, private keys, wallet password or other wallet credentials, bank account information, payment card numbers, government-issued ID numbers. BleepingComputer reports a seller on a crime forum advertising the same set, with a matching date range and customer count, which is why the phishing built on it will be specific enough to sound real.
SafePal security update and customer email, 16 August 2026. Reported by BleepingComputer, CoinDesk, The Block, Crypto Briefing and Infosecurity Magazine, 16-17 August 2026.
If your SafePal account was hacked: start recovery at the official page (www.safepal.com/en/scam-protection), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your SafePal account, step by step
These steps follow SafePal’s official process — expect it to take the order check takes minutes; the exposed address is the part that needs real work. Official links only: account recovery · password reset.
Check your status the boring way. Open safepal.com yourself and use the company's own check page with your order number and shipping country. SafePal also emailed the customers it identified on 16 August, but that email is precisely what an attacker would imitate, so do not act on the one in your inbox.
Leave your recovery phrase alone and ignore anything that asks about it. SafePal's advice is blunt: never share it with anyone, and never enter it anywhere you were prompted to by an unsolicited message, however well that message knows your order.
Treat firmware prompts as hostile unless you started them. The phishing in this case leans on an invented vulnerability that supposedly needs an urgent update. Genuine firmware arrives through the SafePal app that you opened yourself, never through a link, an attachment or a support agent who contacted you first.
If you have already given the recovery words away, move the funds now: set up a new wallet with a new recovery phrase and transfer everything to it. Nobody reverses a crypto transaction, and no recovery agent who reaches out to you first is real.
Then deal with the part that outlives the news cycle. Get the address and phone number off the people-search sites that publish them, and check whether the email you used at checkout appears in known breach data, because that is where the next round of target lists comes from.
What trips people up with SafePal
- The scam wave arrived before the announcement did. BleepingComputer's account has customers receiving emails about an urgent firmware vulnerability months before SafePal published anything, and that is the detail worth keeping: whoever held those order records had them for a long while. Any message about a firmware upgrade, a return, a refund or a legal investigation touching your wallet is the follow-up to this leak rather than customer service.
- SafePal is specific about what was not in the data, and that list is the reason not to panic: no seed phrase, no private keys, no wallet password or other wallet credentials, no bank account details, no card numbers, no government-issued ID numbers. The company says it found no evidence that the incident itself gave anyone access to wallets or funds, and that a wallet needs replacing only if its owner has already handed the recovery words to somebody.
- The flaw was mundane and it lived in the shop, not the wallet. SafePal describes an authorization problem in the order-tracking function of a plug-in that, under certain conditions, showed one customer another customer's order. It says the hole is closed, extra checks are in place, an independent security firm was brought in to validate the work, and order data is now kept for 90 days. None of that un-leaks the records already taken.
- There is an official way to check and using anything else is the trap. SafePal put a page on its own site where you enter an order number and shipping country to see whether that order is in the affected set, and it says it has removed more than 30 fraudulent websites and phishing links tied to the incident. Type safepal.com yourself. A breach checker that arrives by email or DM and wants a wallet address or a recovery phrase is the second attack.
- This is the second wallet-buyer address leak in a week, after the ShipMonk breach behind Trezor's notice, and it lands the same way: a list of named people who own crypto and where their parcels go. The physical side is worth a thought, from who signs for your deliveries to what your building's mailroom hands over. The digital side is that the address sits on people-search sites regardless of this breach.
Was SafePal hacked, and are my funds at risk?
The wallets were not touched; the shop's order records were. SafePal's security update of 16 August 2026 describes an authorization flaw in the order-tracking function of a plug-in that, under certain conditions, allowed unauthorized access to another customer's order information. Roughly 39,798 customers are affected, drawn from orders placed between 2 March 2025 and 11 April 2026. The company says it has found no evidence that the incident itself compromised access to SafePal wallets or funds.
The exposed fields are name, email address, shipping address, phone number and purchase details. SafePal states that seed phrases, private keys, wallet passwords and other wallet credentials were not exposed, and neither were bank account information, payment card numbers or government-issued identification numbers. Its remediation list is public: the flaw fixed, additional security measures added, an independent security firm engaged to validate the work, retention in order-processing systems cut to 90 days, third-party logistics partners asked to investigate, and more than 30 fraudulent websites and phishing links taken down.
The uncomfortable parts are the timing and the resale. BleepingComputer reports that a threat actor has advertised the data on a cybercrime forum, citing the same customer count and date range and offering order IDs and shipping countries as proof, and that customers were already getting phishing built on accurate order details before the company disclosed anything. Practically, treat those details as public from now on: a message that knows what you bought and where it went is not genuine for that reason, and a real SafePal notice never asks for a recovery phrase.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in SafePal's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from SafePal?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for SafePal). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
The attacker spent, moved or stole money
Report the unauthorized transactions to SafePal through the official flow the moment you're back in (or even before — fraud reports don't require account access). U.S. consumer protections for electronic transfers generally limit your liability the faster you report, so speed matters more than completeness. Also call the bank or card issuer behind the funding source — they can dispute, reverse or block further charges — and file at reportfraud.ftc.gov so the pattern is on record.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on SafePal (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when SafePal itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked SafePal account, answered
How did my SafePal account get hacked?
The most common cause isn't a hack of SafePal itself — it's credential stuffing: a password you used on SafePal leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake SafePal login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my SafePal account back?
Usually yes. Use the official recovery flow (https://www.safepal.com/en/scam-protection) — it can verify you even when the attacker changed the email and password. Expect it to take the order check takes minutes; the exposed address is the part that needs real work; respond quickly to follow-ups so the case stays open.
Should I just make a new SafePal account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so SafePal can lock it, before you start over.
Will I get money back that was stolen through my SafePal account?
Often, if you move fast. Report the unauthorized activity to SafePal and to the bank or card behind it — U.S. protections for unauthorized electronic transfers generally limit your losses the sooner you report. Peer-to-peer payments you were tricked into sending yourself are much harder to recover than transactions the attacker made — another reason to report the takeover itself, with evidence.
Was my SafePal seed phrase or private key leaked?
No. SafePal says the exposed data covers names, email addresses, shipping addresses, phone numbers and purchase details, and that seed phrases, private keys, wallet passwords and other wallet credentials were not in it, along with bank details, card numbers and government ID numbers. Nobody can move your funds with an order record.
Do I need to replace my SafePal wallet after the breach?
Not according to the company, which says there is no evidence the incident gave anyone access to wallets or funds. Replace the wallet, meaning a fresh device or at least a new recovery phrase with the funds moved across, only if you have already shared your recovery words with someone posing as support.
How do I check whether my SafePal order was affected?
SafePal published a page on its own site where you enter your order number and the shipping country and it tells you whether that order is in the affected set. Reach it by typing safepal.com yourself. Any other checker, especially one that arrived by email and wants a wallet address, is part of the scam.
How did the SafePal data breach happen?
Through an authorization flaw in the order-tracking function of a plug-in, which under certain conditions let one customer see another customer's order information. SafePal says orders placed between 2 March 2025 and 11 April 2026 were exposed, about 39,798 customers in total, and that the flaw has since been fixed and independently reviewed.
Is the stolen SafePal customer data being sold?
BleepingComputer reports that a threat actor advertised the data on a cybercrime forum, quoting the same affected period and customer count and offering order IDs and shipping countries as proof of what they hold. Assume the details are circulating, and judge incoming messages on how they reached you rather than on what they know.
How do I stop my SafePal account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.