SafePal Breach Leaks 39,798 Customer Records

The exposure here is physical-world identity data, not seed phrases or private keys, which shifts the risk from drained wallets to phishing, SIM-swap and home-address targeting of known crypto holders. The 14-month window matters: this was a persistent plugin flaw, not a one-off slip, raising questions about how third-party order-tracking components are vetted across wallet providers. For an industry selling self-custody as the answer to exchange risk, the reminder is that the leaky part is often the retail logistics layer. Whether the affected users are notified directly, and how quickly the plugin class of vulnerabilities is audited elsewhere, is the open question.