SafePal says an order-tracking flaw exposed data from 39,798 hardware-wallet buyers and is reviewing claims that the dataset is being offered for sale.