--- title: SafePal breach leaks the addresses but not the crypto,... description: SafePal, the Binance-backed crypto wallet maker, disclosed a breach affecting nearly 40,000 customers who ordered between March 2025 and April 2026, exposing... canonical: https://daily.dev/posts/safepal-breach-leaks-the-addresses-but-not-the-crypto-which-may-be-the-bigger-problem-k7llde8zh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SafePal breach leaks the addresses but not the crypto, which may be the bigger problem | daily.dev og:description: SafePal, the Binance-backed crypto wallet maker, disclosed a breach affecting nearly 40,000 customers who ordered between March 2025 and April 2026, exposing... og:url: https://daily.dev/posts/safepal-breach-leaks-the-addresses-but-not-the-crypto-which-may-be-the-bigger-problem-k7llde8zh og:image: https://api.daily.dev/og/posts/K7LldE8Zh.png og:image:alt: SafePal breach leaks the addresses but not the crypto, which may be the bigger problem og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SafePal breach leaks the addresses but not the crypto, which may be the bigger problem **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary SafePal, the Binance-backed crypto wallet maker, disclosed a breach affecting nearly 40,000 customers who ordered between March 2025 and April 2026, exposing names, physical addresses and contact details. No cryptocurrency, private keys, passwords, or payment details were compromised. The root cause was an authorization flaw (an insecure direct object reference) in a third-party order-tracking plug-in, letting attackers view other customers' orders by manipulating order numbers. SafePal patched the flaw, hired an independent auditor, shortened data retention to 90 days, removed over 30 phishing sites, and offered a breach-check tool. The bigger concern raised is that leaked physical addresses of known crypto holders create phishing and 'wrench attack' risks, since irreversible crypto transactions make in-person coercion a real incentive. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What caused the SafePal data breach that exposed customer addresses? An authorization flaw in a third-party plug-in used for order tracking allowed attackers to view other customers' order details by manipulating order numbers, a classic insecure direct object reference (IDOR) vulnerability. The breach affected roughly 39,798 customers who ordered between March 2, 2025 and April 11, 2026, exposing names, physical addresses, and contact details but no crypto funds, keys, or passwords. _Teams wiring up third-party plug-ins can track IDOR fixes and breach disclosures like this on daily.dev._ ### Why is leaking physical addresses of crypto holders considered dangerous even if their crypto wasn't stolen? Leaked names and addresses of confirmed crypto owners create risk beyond phishing because crypto transactions are irreversible and hard to trace, giving attackers incentive to physically confront victims in so-called 'wrench attacks' to coerce them into handing over keys in person. Reports of crypto holders being targeted, robbed, or worse have climbed, making a list of confirmed owners with delivery addresses especially dangerous. _Anyone assessing privacy risk in crypto products can follow security writeups like this on daily.dev._ ## Similar posts on daily.dev - [Crypto hardware wallet owners face fresh security risks after recent spate of personal data thefts](https://daily.dev/posts/crypto-hardware-wallet-owners-face-fresh-security-risks-after-recent-spate-of-personal-data-thefts-cfoxbggml) · TechCrunch · 0 upvotes · 0 comments - [Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider](https://daily.dev/posts/scammers-target-hundreds-of-thousands-of-crypto-owners-after-trezor-confirms-data-breach-of-email-pr-je4d4ipgf) · TechCrunch · 1 upvotes · 0 comments --- Tags: [#crypto](https://daily.dev/tags/crypto), [#phishing](https://daily.dev/tags/phishing), [#data-breach](https://daily.dev/tags/data-breach), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/safepal-breach-leaks-the-addresses-but-not-the-crypto-which-may-be-the-bigger-problem-k7llde8zh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SafePal breach leaks the addresses but not the crypto, which may be the bigger problem","url":"https://daily.dev/posts/safepal-breach-leaks-the-addresses-but-not-the-crypto-which-may-be-the-bigger-problem-k7llde8zh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/safepal-breach-leaks-the-addresses-but-not-the-crypto-which-may-be-the-bigger-problem-k7llde8zh"},"datePublished":"2026-08-17T09:08:14.671Z","dateModified":"2026-08-17T09:09:24.447Z","description":"SafePal, the Binance-backed crypto wallet maker, disclosed a breach affecting nearly 40,000 customers who ordered between March 2025 and April 2026, exposing...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9e7415266e237d2e919f404548abba2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9e7415266e237d2e919f404548abba2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/safepal-breach-leaks-the-addresses-but-not-the-crypto-which-may-be-the-bigger-problem-k7llde8zh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"crypto,phishing,data-breach,appsec","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"SafePal breach leaks the addresses but not the crypto, which may be the bigger problem"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/safepal-breach-leaks-the-addresses-but-not-the-crypto-which-may-be-the-bigger-problem-k7llde8zh#faq","mainEntity":[{"@type":"Question","name":"What caused the SafePal data breach that exposed customer addresses?","acceptedAnswer":{"@type":"Answer","text":"An authorization flaw in a third-party plug-in used for order tracking allowed attackers to view other customers' order details by manipulating order numbers, a classic insecure direct object reference (IDOR) vulnerability. The breach affected roughly 39,798 customers who ordered between March 2, 2025 and April 11, 2026, exposing names, physical addresses, and contact details but no crypto funds, keys, or passwords. Teams wiring up third-party plug-ins can track IDOR fixes and breach disclosures like this on daily.dev."}},{"@type":"Question","name":"Why is leaking physical addresses of crypto holders considered dangerous even if their crypto wasn't stolen?","acceptedAnswer":{"@type":"Answer","text":"Leaked names and addresses of confirmed crypto owners create risk beyond phishing because crypto transactions are irreversible and hard to trace, giving attackers incentive to physically confront victims in so-called 'wrench attacks' to coerce them into handing over keys in person. Reports of crypto holders being targeted, robbed, or worse have climbed, making a list of confirmed owners with delivery addresses especially dangerous. Anyone assessing privacy risk in crypto products can follow security writeups like this on daily.dev."}}]} ```