/wallets · sin verificar

SafePal

Name: SafePal
Brand: SafePal

Wallet hardware multi-cadena con soporte Monero vía Monero GUI. Grade C. Incidente al momento del listado: brecha del plugin de order-tracking 2026-08-16 expuso ~39.798 clientes con full PII (nombre + email + dirección + teléfono + detalles de compra) en ventana de 13 meses (2025-03-02 al 2026-04-11). Riesgo físico, no phishing. Leé el bloque de incidente antes de comprar.

⚠ INCIDENT

⚠ Incidente 2026-08-16 severidad: high

SafePal disclosed on 2026-08-16 (blog: "Unauthorized Access To A Subset Of Customer Order Information") that a flaw in their order-tracking plug-in led to unauthorized access to customer information for approximately 39,798 customers who placed orders between 2025-03-02 and 2026-04-11 — a 13-month window. Exposed data: full names, email addresses, shipping addresses, phone numbers, and purchase details. Wallets, seed phrases, private keys, and wallet passwords are not affected — the exposure is entirely on the fulfillment / order-tracking supply chain. The reader-facing risk is not phishing (SafePal's own framing) — it is physical: confirmed crypto-holder home addresses in the hands of any buyer of the leaked data is home-invasion / stalking / $5-wrench-attack territory. Affected customers notified individually by email; verification available at safepal.com/scam-protection using order ID + shipping country. This is the second major hardware-wallet supply-chain PII exposure in 5 days (Trezor 2026-08-13 exposed 11,742 customers over a 90-day window). See /guides/old-iphone-cold-storage for the shipping-address opsec response.

Consejo del curador:

Cronología del incidente

2026-08-20auto SafePal posted an 18 August follow-up on its 16 August incident blog acknowledging unverified claims that the ~39,798-record order dataset is being offered for sale, while restating that seed phrases, keys, and wallet credentials were not in scope. A cybercrime-forum listing matching the disclosed order window and c…
2026-08-28auto SafePal posted an official X progress note on 2026-08-23: still finalizing 4 anti-phishing vendors and 3 independent auditors, still monitoring dark-web sale/publication claims, and reviewing order/shipping data held. The official blog is unchanged since its 2026-08-18 addendum; victim count (~39,798), data types, a…

INCIDENT-2026-08 multi-chain MONERO-CAPABLE multi-chain monero support

Visitar SafePal → ⚠ Reportar Espejo Markdown Compartir ↗

Visión general

Grado: C
Tarifas: Hardware wallet purchase price varies by model (S1 / X1 / X1 Pro / Cypher). Free companion app. Fee schedule for on-app swaps varies by integration; verify at purchase time.
Incidente: ⚠ Activo desde 2026-08-16 — /incidents

C ¿Por qué grado C?

Acceptable with reservations. Posture intact but evidence is older, lighter, or the provider sits on a known weakness (custody risk, history of customer-fund freezes resolved, etc.).

Rubric completo + recorrido de verificación de 7 pasos en /methodology.

veredicto editorial · conclusión

Veredicto del Curador y Análisis OpSec

CONCLUSIÓN

SafePal se mantiene en el índice para fines comparativos, pero presenta reservas relevantes en custodia o verificación que exigen precaución.

✓

Puntos Fuertes

▸ Proveedor registrado y revisado activamente en el directorio de billetera Monero de xmr.club.

⚠

Advertencias y Riesgos OpSec

▸ INCIDENTE ACTIVO (2026-08-16): SafePal disclosed on 2026-08-16 (blog: "Unauthorized Access To A Subset Of Customer Order Information") that a flaw in their order-tracking plug-in led to unauthorized access to customer information for approximately 39,798 customers who placed orders between 2025-03-02 and 2026-04-11 — a 13-month window. Exposed data: full names, email addresses, shipping addresses, phone numbers, and purchase details. Wallets, seed phrases, private keys, and wallet passwords are not affected — the exposure is entirely on the fulfillment / order-tracking supply chain. The reader-facing risk is not phishing (SafePal's own framing) — it is physical: confirmed crypto-holder home addresses in the hands of any buyer of the leaked data is home-invasion / stalking / $5-wrench-attack territory. Affected customers notified individually by email; verification available at safepal.com/scam-protection using order ID + shipping country. This is the second major hardware-wallet supply-chain PII exposure in 5 days (Trezor 2026-08-13 exposed 11,742 customers over a 90-day window). See /guides/old-iphone-cold-storage for the shipping-address opsec response.
▸ Solo superficie clearnet: no ofrece espejo .onion oficial; expone la IP del usuario salvo uso de VPN/Tor.

Reseña

Incidente al momento del listado (2026-08-16). Divulgación propia de SafePal (`safepal.com/scam-protection`): un flaw en su plugin de order-tracking permitió acceso no autorizado a información de pedido de aproximadamente 39.798 clientes que ordenaron entre 2025-03-02 y 2026-04-11 — ventana de 13 meses. Datos expuestos: nombre completo, email, dirección de envío, teléfono, detalles de compra. Wallets, seed phrases, private keys y wallet passwords no afectados — la brecha es enteramente en la cadena de fulfillment / order-tracking. El framing público de SafePal lidera con "las wallets siguen seguras" + phishing warning — técnicamente cierto y completamente al lado del punto. El riesgo reader-visible no es phishing, es físico: 39.798 direcciones de crypto-holders confirmados en el mercado negro es territorio de allanamiento / acoso / ataque de la llave inglesa. Ver `/guides/old-iphone-cold-storage`.

En contexto de la categoría. SafePal es el segundo vendor de hardware wallets exponiendo PII de clientes vía brecha de supply-chain en 5 días. Trezor (2026-08-13) expuso 11.742 clientes en ventana de 90 días; SafePal (2026-08-16) expone ~39.798 clientes en ventana de 13 meses — combinado 51.540 registros de clientes de hardware wallets con full home-address PII en el mercado negro en cinco días. Sumando Coldcard 2026-07-30 firmware-RNG (~594 BTC drenados en ~500 wallets por bug de weak-entropy latente 5 años — ver `/guides/hardware-wallets-for-monero-after-coldcard`), la superficie de trust de hardware wallets tomó tres golpes distintos en 18 días. El patrón es categoría-wide, no vendor-específico.

Cautelas. La cadena de fulfillment de SafePal, específicamente el plugin de order-tracking breachado en ventana de 13 meses y solo detectado después de que empezaran phishing emails en mayo 2026. Mitigaciones: PO box, drop shipper, mail-forwarding, o el patrón separate-iPhone en la guía linked.

Alternativas. Para airgap: Cupcake Wallet + old iPhone/Android via el patrón de `/guides/old-iphone-cold-storage`. Para mantener hardware wallet: rotación de dirección de envío antes de tu próxima orden.

Tarifas

Hardware wallet purchase price varies by model (S1 / X1 / X1 Pro / Cypher). Free companion app. Fee schedule for on-app swaps varies by integration; verify at purchase time.

Enlaces

WEB https://safepal.com/

Rastro de auditoría — recibos del reclamo editorial

● UPSTREAM Activo · HTTP 200 · 188ms · comprobado 10h ago
○ ONION Sin .onion espejo
⚠ MANUAL Sin last_verified sello — ver /freshness
⌕ LOG Ver log del curador para SafePal

Reseñas — moderado · reglas

Aún no hay reseñas. Sé el primero.

Añadir reseña

Feedback honesto y neutral bienvenido. El curador aprueba antes de mostrarse. Sin JS.