The company stressed that the breach did not expose seed phrases, private keys, wallet passwords, bank‑account or payment‑card details, nor government‑issued identification numbers.

Because the leaked order data includes names, shipping addresses and transaction amounts, attackers could craft convincing phishing emails or impersonate victims to steal more information.

SafePal has patched the vulnerability, announced that personal data will be kept in its order‑processing system for only 90 days, and reported that it has taken down more than 30 fraudulent websites and phishing links linked to the incident.

Users should treat any unexpected messages that reference their SafePal purchases with suspicion and verify the sender before clicking links or sharing personal details.