SafePal
An exchange asks for a government ID and your face before you can trade. Money-laundering rules then attach that identity to your transfers and pass it to the exchange at the other end. Closing the account does not clear the file: the same rules keep it for at least five years after you leave.
Reported incidents
Order-tracking flaw exposed 39,798 wallet buyers' home addresses
2026-08-16Affected Order-tracking plug-in on its web shop
SafePal, which sells crypto hardware wallets, said an authorisation flaw in a plug-in used to track customer orders let attackers see other customers' order data. The incident affected 39,798 people who ordered between 2 March 2025 and 11 April 2026. Exposed data included names, email addresses, shipping addresses, phone numbers and order details. SafePal said a separate configuration error had kept data from being deleted between September 2025 and April 2026. The data was offered for sale on crime forums. SafePal said seed phrases, private keys, passwords and payment data were not exposed, and it has cut its retention to 90 days.
People affected typically ask SafePal to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.