SafePal says scammers are sending physical phishing letters to customers in Italy using personal information exposed in the company’s August data breach. The campaign uses recipients’ real names, home addresses and order details, according to the wallet maker.
The letters reportedly claim there is a firmware problem with the customer’s hardware wallet and direct recipients to scan a QR code. That code leads to a fake SafePal website designed to steal recovery phrases, which would allow attackers to access any funds controlled by the wallet.
Fake letters use leaked customer data
According to SafePal, the mailed letters are not legitimate company communications. Both the printed letter and the phishing site display the customer’s real name, address and purchase information, making the scam appear credible.
The fraudulent site is hosted on Arweave, a network used for permanent file storage. SafePal linked the mail campaign to the customer information exposed in its earlier breach and said the current targets are Italian users.
Attackers aim for seed phrases, not the devices
SafePal said its wallet infrastructure remains secure and that the scam is aimed at tricking owners rather than compromising the hardware itself. The letters claim the recipient’s wallet has a firmware flaw, but the real goal is to get the victim to enter a recovery phrase on the fake website.
A recovery phrase can rebuild a wallet on another device. If a user submits those backup words to a phishing page, the attacker can take control of the assets held in that wallet. SafePal said it will never send physical letters or ask customers for seed phrases.
Breach affected 39,798 orders
SafePal disclosed on August 16 that a vulnerability in an order-tracking plug-in exposed customer orders placed between March 2025 and April 2026. The company said 39,798 customers were affected.
The leaked information included names, email addresses, street addresses, phone numbers and purchase details. SafePal said recovery phrases, private keys and card numbers were not exposed in that incident.
What SafePal says happens next
SafePal urged anyone who receives one of the letters to report it through the company’s scam-protection page. It specifically asked recipients to include the QR code so the fraudulent site can be identified and taken down.
The episode highlights a longer-tail risk from address leaks tied to hardware wallet sales: unlike passwords, home addresses and past order details do not expire. The company’s confirmed guidance is that customers should treat any physical letter requesting wallet recovery information as a scam.
Source: beincrypto.com