Scammers Mail Fake SafePal Letters After Data Breach

Fraudulent letters are arriving at the homes of SafePal customers in Italy. The correspondence uses personal details drawn from a data breach that compromised the information of almost 40,000 purchasers of the firm's hardware wallets.

SafePal has stated that its devices are not compromised; the letters are aimed at their owners. If a wallet recovery phrase is entered on a spoof site, the scammers can drain all the funds from that wallet.

Mechanics of the SafePal Phishing Letters

The letters inform the recipient that their device is affected by a software defect.

Clienti italiani di @SafePal stanno ricevendo lettere fisiche molto credibili, con i dati corretti e un link personalizzato.

Si tratta di un tentativo di phishing. Qui i dettagli: https://t.co/YzHzcLU4OQ

— Criptovaluta.it (@CriptovalutaI) November 12, 2026

A QR code in the letter directs users to a counterfeit SafePal website hosted on Arweave. The letter and the website feature the recipient's actual name, address, and order details.

On Thursday, SafePal acknowledged the fraudulent activity on X, connecting it to a data incident that occurred in August.

“These letters are NOT from SafePal, and wallet infrastructure remains secure. SafePal will never send physical letters or ask for seed phrases,” the team confirmed.

The firm urged recipients to file reports via its scam-protection portal, attaching a photo of the QR code so the fake domain can be taken down.

Why Physical Address Leaks Continue to Benefit Scammers

On August 16, SafePal disclosed that a flaw in an order-tracking plug-in had exposed details of 39,798 customers who bought products between March 2025 and April 2026.

The data leak included names, email addresses, physical addresses, phone numbers, and purchase details. The company stated that recovery phrases, private keys, and card numbers were not compromised.

At the time of the breach, BeInCrypto warned that leaked physical addresses do not lose their value over time.

This is a known tactic. Ledger's 2020 breach exposed the postal addresses of roughly 272,000 users, and counterfeit Ledger letters appeared in the mail in 2025.

Trezor's shipping partner inadvertently exposed 13,689 customer records in August. Neither SafePal nor Trezor has reported any breach of the hardware wallets themselves.