According to CoinMeta, Safepal announced that due to a flaw in the order plugin, the data of 39,798 users was leaked. The hardware wallet manufacturer emphasized that unauthorized threat actors obtained users' order data through a faulty plugin. This incident occurred between March 2, 2025, and April 11, 2026, exposing users to the risk of phishing attacks and fraudulent calls.