SafePal

Live incident (2026-08-16). SafePal's own disclosure (`safepal.com/scam-protection`): a flaw in their order-tracking plug-in led to unauthorized access to customer order information for approximately 39,798 customers who placed orders between 2025-03-02 and 2026-04-11 — a 13-month window. Exposed data: full names, email addresses, shipping addresses, phone numbers, purchase details. Wallets, seed phrases, private keys, wallet passwords are unaffected — the breach is entirely on the fulfillment / order-tracking supply chain. SafePal's public framing leads with the standard *"wallets are secure"* / phishing-risk warning — technically true and beside the point. The reader-facing risk is not phishing; it is physical: 39,798 confirmed crypto-holder home addresses on the black market is home-invasion / stalking / $5-wrench-attack territory. See `/guides/old-iphone-cold-storage` for the shipping-address-opsec reframe + a step-by-step alternative that closes this class of exposure entirely.

What this is in category context. SafePal is the second major hardware-wallet vendor to expose customer PII via supply-chain breach in 5 days. Trezor (2026-08-13) exposed 11,742 customers over a 90-day window; SafePal (2026-08-16) exposes ~39,798 customers over a 13-month window — combined 51,540 hardware-wallet customer records with full home-address PII on the black market in five days. Add Coldcard's 2026-07-30 firmware-RNG incident (~594 BTC drained across ~500 wallets from a 5-year-latent weak-entropy bug — see `/guides/hardware-wallets-for-monero-after-coldcard`) and the hardware-wallet trust surface has taken three distinct hits in 18 days: device firmware trust, supply-chain PII (Trezor), and supply-chain PII again with 3.4× the count and 13× the window (SafePal). The pattern is category-wide, not vendor-specific.

What SafePal is. Multi-chain hardware wallet family (S1, X1, X1 Pro, Cypher) with support for Bitcoin, Ethereum, Solana, and (via Monero GUI integration for select models) Monero. Vendor: SafePal Inc. (Singapore, founded 2018 per public record; verify on their /about surface).

What you trust. The device itself (Secure Element architecture; firmware model per model varies). Wallet cryptography and signing paths appear standard for the multi-chain HW category.

What you don't. SafePal's fulfillment supply chain — specifically the order-tracking plug-in that was breached over a 13-month window and only detected after phishing emails started reaching customers in May 2026 (per SafePal's FAQ: *"I received phishing emails in May. Why did it take until August to confirm the cause?"*). Mitigations: PO box, drop shipper, mail-forwarding service, or the separate-iPhone pattern in the linked guide.

Alternatives. For the airgap use case specifically: Cupcake Wallet (by the Cake Wallet team) on an old iPhone / Android — purpose-built for the airgap-signer role, avoids the shipping-address surface entirely. For a hardware wallet without changing the pattern: rotate through a shipping-privacy layer before your next order.

Cross-refs. Parent guide: `/guides/monero-cold-storage`. Alternative pattern: `/guides/old-iphone-cold-storage`. After-Coldcard trust model: `/guides/hardware-wallets-for-monero-after-coldcard`. Verify-your-binary: `/guides/verify-wallet-binary`.