SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. 

The affected records covered orders placed between March 2, 2025, and April 11, 2026, and included names, email addresses, shipping addresses, phone numbers and purchase details. SafePal said it emailed affected customers individually on Sunday and launched a tool allowing buyers to check orders using their order number and shipping country.

The wallet provider said seed phrases, private keys, wallet passwords, payment card numbers, bank account information and government-issued identification numbers were not exposed. SafePal also said it found no evidence that the incident itself compromised wallet access or customer funds.

SafePal traced the exposure to an order-tracking flaw

SafePal said the issue involved an authorization defect in a plugin used to track orders. Under certain conditions, the flaw allowed unauthorized access to another customer’s order information. The company said it fixed the vulnerability and introduced additional access controls after identifying it.

The company’s incident FAQ provides a longer timeline. SafePal said it first received a phishing report consistent with the problem in early May. It initially treated the report as an isolated case before escalating it into a formal security investigation. In July, the company began a full review and rebuild of its order-processing pipeline and confirmed the plugin flaw during that investigation.

Data-retention failure widened the affected period

SafePal separately disclosed that a scheduled data-cleanup process stopped working correctly between September 2025 and April 2026 because of a configuration error. According to the company, that failure did not cause the unauthorized access but left older order records stored longer than intended, helping extend the affected range back to March 2025.

SafePal has now reduced personal-data retention in the relevant order-processing environment to 90 days, subject to legal requirements. It said affected customers’ personal information has been removed from active e-commerce servers, while an encrypted offline copy is being retained to support potential investigations.

Phishing is now the main risk for customers

The exposed information could help attackers create more convincing phishing attempts using genuine names, addresses and purchase details. SafePal said it has already identified and taken down more than 30 fraudulent websites and phishing links tied to scam activity and continues monitoring for new domains.

The risk resembles other recent wallet-industry incidents. As crypto.news reported, a third-party shipping breach exposed personal information belonging to 13,689 Trezor customers, including names, emails, phone numbers and shipping addresses. In related coverage, scammers have also mailed fake Trezor and Ledger letters containing QR codes designed to steal recovery phrases.

SafePal stressed that it never asks customers for seed phrases, private keys or passwords. It said users do not need to move assets solely because their order information was exposed. However, anyone who has already entered a seed phrase or private key into a suspicious website should “treat that wallet as compromised,” create a new wallet and transfer remaining assets.

What happens next

SafePal said it is engaging an independent third-party security firm to validate its fix and conduct a broader review of its order-processing systems. The firm has not yet been named publicly. SafePal also contacted logistics and fulfillment partners and said it has found no evidence so far that the incident extended into their systems.

The company has opened a dedicated support channel and says it is contacting on-chain asset-tracing specialists for customers reporting financial losses. SafePal cautioned that this “does not represent any admission of liability or commitment to compensation.” It has not identified the unauthorized party or disclosed a confirmed amount lost through follow-on phishing. Further findings are expected through its official security updates.

Bits of Gold, Israel’s regulated crypto broker, is investigating a cyber incident that may have exposed customer identity and financial information after unauthorized access to a third-party system used for support and data analysis. 

The company notified customers on Aug. 16 and said it had blocked the access, disconnected the affected system from its information sources and informed relevant authorities, Calcalist reported.

The company said its review indicates “there may have been access to certain personal information,” including names, ID numbers, emails, phone numbers, IP addresses, bank account details and public crypto wallet addresses. It said digital assets, account passwords, scanned ID documents, full credit card details and CVV codes were unaffected. Bits of Gold also said “there is no indication” so far that the potentially exposed information has been used.

Bits of Gold links breach to a broader third-party incident

Bits of Gold said the incident formed part of a broader cyber event involving a software company it uses and other businesses worldwide. Calcalist reported that hundreds of companies may have been affected and that Bits of Gold was not believed to have been directly targeted. The software provider has not been publicly identified in the disclosures reviewed.

Reports circulating Sunday put the potentially affected customer count at roughly 200,000. That figure should be treated cautiously. The customer notice reproduced by Calcalist does not state how many records were accessed, while the company’s site says it has more than 300,000 customers. Bits of Gold has not publicly confirmed that 200,000 people were affected.

Exposed details could increase phishing risk

The main immediate risk is social engineering rather than theft from customer wallets through the reported incident itself. Names, phone numbers, emails, banking information and public wallet addresses could give attackers data for more convincing messages impersonating Bits of Gold, a bank or another financial service. Bits of Gold specifically warned customers about phishing and impersonation attempts.

The company told users not to provide passwords, verification codes or private keys and not to transfer money or digital assets in response to unsolicited approaches. The warning follows another third-party exposure in the crypto sector: as crypto.news reported, a ShipMonk breach exposed personal information belonging to 13,689 Trezor customers, prompting similar concerns about targeted phishing.

Bits of Gold operates under Israeli financial regulation

Bits of Gold operates under financial services license 56716. The company says it was the first active Israeli crypto business to receive a permanent financial services license from the Capital Market, Insurance and Savings Authority. Its website lists more than 300,000 customers, while Calcalist described it as the first currently active company among nine businesses licensed to trade cryptocurrencies by the authority.

Its regulatory profile expanded this year with BILS, a shekel-pegged stablecoin. Bits of Gold says regulators approved BILS for issuance and distribution on April 27 after a roughly two-year sandbox. As crypto.news previously reported, Israel approved the BILS shekel stablecoin after its regulatory pilot, with Bits of Gold saying each token is backed 1:1 by shekels held in reserve.

What happens next

Bits of Gold said its security team has begun a comprehensive review with a specialist cyber incident response company and continues to monitor its systems. It also said relevant authorities have been notified. Services remain operational, and the company has told customers that no account action is currently required.

The next key disclosures will be the confirmed number of affected customers, the identity of the compromised software provider, the exact scope of accessed records and whether investigators find evidence that the data was misused. Until then, the widely reported 200,000-customer figure and the full scale of the incident remain unconfirmed by Bits of Gold.

The breach has impacted 39,798 customers who placed orders between March 2, 2025 and April 11, 2026.

SafePal stressed that the core security of its wallets remains intact, adding that users’ seed phrases, private keys, bank passwords, bank account information, payment card numbers, and government-issued IDs were not affected.

However, SafePal said users who have shared their private keys or seed phrases via a phishing email, phone call, or letter should treat their wallet as compromised and transfer their assets to a new wallet.

How SafePal is responding

The company said it had patched the vulnerability and introduced additional security measures in response. SafePal notified all affected customers by email from security@safepal.com on Sunday and hired an independent third-party security firm to audit the fix and review its order-processing systems.

SafePal also said it would retain customers’ personal data in its order-processing system for only 90 days from the date of collection. In addition, the company identified and removed more than 30 fraudulent websites and phishing links associated with the breach.

Customers can use a verification tool on SafePal’s website to check whether their data was affected, the company said.

DefiLlama delayed the public launch of its mobile application while trying to remove applications impersonating the DeFi analytics platform from Apple’s App Store, pseudonymous founder 0xngmi said on Aug. 15. 

The team eventually demonstrated that one fake application could drain a funded crypto wallet before Apple removed it, according to his post.

0xngmi said DefiLlama had reported the application for months over trademark and impersonation concerns without securing its removal. The team then funded a small test wallet, downloaded the application and watched the funds disappear. “App was taken down in days after that,” he wrote. The amount drained from the test wallet was not disclosed.

DefiLlama waited until fake apps were removed

The security problem directly affected DefiLlama’s product rollout. 0xngmi said the company “waited ’till all the fake apps were taken down before we launched ours to avoid any user getting scammed.” That timeline is DefiLlama’s account and has not been independently confirmed by Apple.

The genuine DefiLlama application is now publicly available. DefiLlama’s official page says its mobile product is live on iOS and Android. Apple’s listing identifies the iPhone application as “DefiLlama: DeFi Tracker,” names DefiLlama as the developer and lists DEFILLAMA LIMITED as the provider.

Meanwhile, Apple’s App Review guidelines prohibit applications that impersonate other apps or services. The rules also bar developers from using another developer’s icon, brand or product name without permission. Repeated impersonation can lead to removal from the Apple Developer Program.

Apple has not publicly addressed 0xngmi’s specific account in the official materials reviewed for this report. The company has previously said its App Review system evaluates applications for security and safety, and Apple reported rejecting more than 320,000 submissions in 2024 because they copied other apps, constituted spam or otherwise misled users.

Fake crypto apps have caused documented losses

The DefiLlama dispute follows other cases where fake cryptocurrency applications reached Apple’s marketplace. As crypto.news reported, a fraudulent Ledger Live application drained 5.9 BTC worth roughly $420,000 from musician Garrett Dutton in April. On-chain researcher ZachXBT traced the stolen Bitcoin to addresses associated with KuCoin.

Apple is also facing a U.S. lawsuit involving  three users who allege fake Sparrow Wallet apps caused $1.835 million in Bitcoin losses. Those allegations have not been tested in court. Apple said in that case that it removed impersonating applications and terminated related developer accounts.

In related coverage, a fake Phantom Wallet application also reached Apple’s App Store before being removed after users reported losing funds.

What happens next

DefiLlama’s official app is now active, and its website provides direct access to the legitimate mobile product. The iOS listing currently shows version 1.0.5 and identifies defillama.com as the developer website, giving users multiple details to verify before installation.

The founder has not disclosed the attacker addresses, amount stolen during DefiLlama’s test or technical analysis of the malicious application. Those details would be needed to independently reconstruct the wallet drain. For users, the clearest verified safeguard is to reach the mobile application through DefiLlama’s official website and confirm the listed developer and provider rather than relying only on an App Store search result.

The European Securities and Markets Authority (ESMA) confirmed it was aware of criminals misusing its identity, name, and logo, including through falsified documents, to convince users that their funds were at risk.

The Netherlands’ Authority for the Financial Markets (AFM) warned that the migration of unregulated crypto exchanges itself was the attack surface. “Fraudulent actors may indeed see an opportunity to scam retail investors who are in the process of looking for an alternative licensed provider,” the AFM told CoinDesk. It urged investors to verify any provider on the official ESMA register before transferring assets, and warned that unsolicited approaches requesting fund transfers should be treated with suspicion.

Austria’s Financial Market Authority issued a similar warning recently. telling retail crypto users that hundreds of platforms lost legal status on July 1 and urged them to verify providers against official databases before moving assets or transferring to self-hosted wallets to avoid migration traps entirely.

Regulator warnings

The scammers’ modus operandi follows a pattern regulators know all too well. The U.K.’s Financial Conduct Authority (FCA) told CoinDesk via email that it has 4,465 reports on record of fake FCA impersonations in the first half of 2025 alone, with 480 victims tricked into handing over money.

Ripple CEO Brad Garlinghouse is scheduled to speak at the Wyoming Blockchain Symposium on Aug. 18, joining U.S. policymakers and financial industry executives as the debate over digital asset regulation moves into another important stretch.

SALT’s updated agenda schedules Garlinghouse’s 15-minute session, “Modernizing Financial Infrastructure,” for 3:05 p.m. Mountain Time at the Four Seasons Resort Jackson Hole. CNBC markets and crypto reporter Tanaya Macheel will moderate.

Ripple CEO’s session focuses on financial infrastructure

Garlinghouse’s appearance is now more specific than when SALT first announced him as a speaker in July. As crypto.news previously reported, Ripple joined the third annual Wyoming gathering before organizers had disclosed his session title or time.

The current agenda does not list an XRP announcement, product launch or new Ripple partnership alongside his session. The “Modernizing Financial Infrastructure” title also provides no detailed discussion topics. Claims that Garlinghouse will unveil an XRP-specific development would therefore go beyond what organizers have confirmed.

U.S. crypto policy will frame the Wyoming event

Garlinghouse will speak on a day carrying a strong U.S. regulatory focus. SEC Chair Paul Atkins is scheduled at 10:00 a.m. for “Inside America’s Regulatory Restructuring.” Senators Tim Scott and Cynthia Lummis follow with a discussion titled “Cementing America’s Financial Leadership.”

EiCrypto has launched a contract-based cloud mining platform designed to help XRP and BTC holders diversify asset participation amid market volatility.

The XRP community is closely monitoring a speech by Ripple CEO Brad Garlinghouse, hoping it will drive up the price of XRP.

According to XRP community member Eri, Ripple CEO Garlinghouse is scheduled to speak at the 2026 Wyoming Blockchain Symposium — co-hosted by SALT and Kraken — in Jackson Hole from August 17 to 20. This invitation-only event, limited to 500 attendees (including heavyweights from the cryptocurrency sector such as SEC Chair Paul Atkins), aims to provide opportunities for focused discussion and networking, with Ripple and the broader XRP ecosystem taking center stage.

According to reports, Garlinghouse is scheduled to speak on the second day of the conference on the topic of “Modernizing Financial Infrastructure.” His presentation aims to take a forward-looking approach to fostering digital asset regulation, creating a global financial system that is decentralized rather than centrally planned, and driving a deeper understanding and adoption of blockchain infrastructure among institutions.

New asset management strategies for XRP holders

At the same time, a fatal problem has been presented to XRP holders. Apart from adopting a simple speculative strategy: buying XRP at a low price and holding it for the long term to wait for the price to rise, which could potentially bring unpredictable profits in the short term if the market is in a bull market, they also face the risk of asset devaluation or a long correction period due to market fluctuations.

Consequently, an increasing number of XRP holders are shifting away from speculative “buy low, sell high” strategies. Instead, they are adopting diversified management approaches that enhance asset utilization and generate cash flow — enabling their XRP holdings to effectively produce passive income in a more stable and sustainable manner.

A new option for XRP holders: EiCrypto Cloud mining

EiCrypto, a leading global digital asset service provider, has launched a brand-new cloud mining platform that is attracting significant attention from XRP investors. Leveraging an innovative contract-based mechanism that links returns to computing power, the platform effectively helps investors — including those holding XRP and BTC — mitigate the risks associated with market stagnation and price volatility, thereby enhancing asset utilization and maximizing returns.

EiCrypto operates mining facilities across more than 100 countries, utilizing over 800,000 mining units powered entirely by renewable energy and situated in regions with low electricity costs and stable infrastructure.

These mining facilities operate continuously to mine cryptocurrency; users do not need to purchase hardware or grapple with technical complexities. Instead, they participate remotely by selecting cloud mining contract plans via the EiCrypto platform, gaining the right to utilize computing power for a fixed contract term. The share of computing power purchased determines the user’s final returns, offering the potential to earn $8,000 per day.

How to quickly join EiCrypto and earn passive income

Register an Account: Sign up here to receive a $15 new-user bonus.

Deposit Methods: EiCrypto supports a wide range of mainstream digital assets; deposit can be made using major cryptocurrencies such as BTC, USDT, ETH, LTC, USDC, XRP, SOL, and BNB.

Select a Contract: Choose a cloud mining contract that suits a particular budget and timeframe; the system will then operate automatically.

Popular Contract Recommendations:

• Entry-level Contract: $100 — 2 days — Total Profit: Approx. $108
• Basic Contract: $500 — 5 days — Total Profit: Approx. $532
• Basic Contract: $1500 — 10 days — Total Profit: Approx. $1705
• Stable Contract: $5500 — 20 days — Total Profit: Approx. $7050
• Stable Contract: $9900 — 25 days — Total Profit: Approx. $14280
• Advanced Contract: $50000 — 35 days — Total Profit: Approx. $79750

Click here to view more contract details.

Once the contract is activated, earnings will be automatically settled to the account after 24 hours. Users can choose to withdraw their earnings or reinvest them, thereby achieving long-term, compound growth of their digital assets.

Environmental sustainability and lawful operations

EiCrypto powers its mining facilities on a large scale using renewable energy sources such as solar and wind power. This approach enhances operational efficiency while effectively reducing carbon emissions, enabling a green, low-carbon model for digital asset computing and creating a safer, more efficient, and sustainable cloud computing ecosystem for global users.

Headquartered in the UK, EiCrypto operates in compliance with relevant UK and European regulatory frameworks and continuously enhances its transparency, operational standards, and user protection mechanisms by aligning with regulatory standards such as MiCA (Markets in Crypto-Assets Regulation) and MiFID II (Markets in Financial Instruments Directive).

In conclusion

As the regulatory framework for digital assets continues to mature, investors are increasingly focusing on diversified strategies that preserve long-term value and enhance asset utilization; leveraging the yield-generating mechanisms of the EiCrypto platform to transform XRP, BTC, and ETH into wealth-generating assets represents the optimal approach today.

For more information, visit the official website and download the application.