# SafePal

Category: wallets
Grade: C
Highlights: INCIDENT-2026-08, MULTI-CHAIN, MONERO-CAPABLE
Features: multi_chain, monero_support
Fees: Hardware wallet purchase price varies by model (S1 / X1 / X1 Pro / Cypher). Free companion app. Fee schedule for on-app swaps varies by integration; verify at purchase time.
Web: https://safepal.com/

## INCIDENT (2026-08-16, severity: high)
SafePal disclosed on 2026-08-16 (blog: "Unauthorized Access To A Subset Of Customer Order Information") that a flaw in their order-tracking plug-in led to unauthorized access to customer information for approximately 39,798 customers who placed orders between 2025-03-02 and 2026-04-11 — a 13-month window. Exposed data: full names, email addresses, shipping addresses, phone numbers, and purchase details. Wallets, seed phrases, private keys, and wallet passwords are not affected — the exposure is entirely on the fulfillment / order-tracking supply chain. The reader-facing risk is not phishing (SafePal's own framing) — it is physical: confirmed crypto-holder home addresses in the hands of any buyer of the leaked data is home-invasion / stalking / $5-wrench-attack territory. Affected customers notified individually by email; verification available at safepal.com/scam-protection using order ID + shipping country. This is the second major hardware-wallet supply-chain PII exposure in 5 days (Trezor 2026-08-13 exposed 11,742 customers over a 90-day window). See /guides/old-iphone-cold-storage for the shipping-address opsec response.

> Multi-chain hardware wallet with Monero support via Monero GUI. Grade C. Live incident: 2026-08-16 order-tracking plug-in breach exposed ~39,798 customers' full PII (name + email + shipping address + phone + purchase details) across a 13-month window (2025-03-02 → 2026-04-11). Physical-safety risk, not phishing risk. Read the incident block before ordering.

## Review

**Live incident (2026-08-16).** SafePal's own disclosure ([`safepal.com/scam-protection`](https://safepal.com/scam-protection)): a flaw in their **order-tracking plug-in** led to unauthorized access to customer order information for approximately **39,798 customers** who placed orders between **2025-03-02 and 2026-04-11** — a **13-month window**. Exposed data: full names, email addresses, shipping addresses, phone numbers, purchase details. Wallets, seed phrases, private keys, wallet passwords are unaffected — the breach is entirely on the fulfillment / order-tracking supply chain. SafePal's public framing leads with the standard *"wallets are secure"* / phishing-risk warning — technically true and beside the point. The reader-facing risk is not phishing; it is physical: 39,798 confirmed crypto-holder home addresses on the black market is home-invasion / stalking / $5-wrench-attack territory. See [`/guides/old-iphone-cold-storage`](/guides/old-iphone-cold-storage) for the shipping-address-opsec reframe + a step-by-step alternative that closes this class of exposure entirely.

**What this is in category context.** SafePal is the second major hardware-wallet vendor to expose customer PII via supply-chain breach in **5 days**. Trezor (2026-08-13) exposed 11,742 customers over a 90-day window; SafePal (2026-08-16) exposes ~39,798 customers over a 13-month window — combined **51,540 hardware-wallet customer records with full home-address PII on the black market in five days**. Add Coldcard's 2026-07-30 firmware-RNG incident (~594 BTC drained across ~500 wallets from a 5-year-latent weak-entropy bug — see [`/guides/hardware-wallets-for-monero-after-coldcard`](/guides/hardware-wallets-for-monero-after-coldcard)) and the hardware-wallet trust surface has taken three distinct hits in 18 days: device firmware trust, supply-chain PII (Trezor), and supply-chain PII again with 3.4× the count and 13× the window (SafePal). The pattern is category-wide, not vendor-specific.

**What SafePal is.** Multi-chain hardware wallet family (S1, X1, X1 Pro, Cypher) with support for Bitcoin, Ethereum, Solana, and (via Monero GUI integration for select models) Monero. Vendor: SafePal Inc. (Singapore, founded 2018 per public record; verify on their /about surface).

**What you trust.** The device itself (Secure Element architecture; firmware model per model varies). Wallet cryptography and signing paths appear standard for the multi-chain HW category.

**What you don't.** SafePal's fulfillment supply chain — specifically the order-tracking plug-in that was breached over a 13-month window and only detected after phishing emails started reaching customers in May 2026 (per SafePal's FAQ: *"I received phishing emails in May. Why did it take until August to confirm the cause?"*). Mitigations: PO box, drop shipper, mail-forwarding service, or the separate-iPhone pattern in the linked guide.

**Alternatives.** For the airgap use case specifically: **Cupcake Wallet** (by the Cake Wallet team) on an old iPhone / Android — purpose-built for the airgap-signer role, avoids the shipping-address surface entirely. For a hardware wallet without changing the pattern: rotate through a shipping-privacy layer before your next order.

**Cross-refs.** Parent guide: [`/guides/monero-cold-storage`](/guides/monero-cold-storage). Alternative pattern: [`/guides/old-iphone-cold-storage`](/guides/old-iphone-cold-storage). After-Coldcard trust model: [`/guides/hardware-wallets-for-monero-after-coldcard`](/guides/hardware-wallets-for-monero-after-coldcard). Verify-your-binary: [`/guides/verify-wallet-binary`](/guides/verify-wallet-binary).

Source: https://xmr.club/wallets/safepal