SafePal Hardware Wallet Users Target Fake Mail Alerts

Fake Security Alerts Target SafePal Owners in the Mail

Imagine opening your mailbox and finding an official-looking letter about your crypto wallet. That is happening to SafePal hardware wallet owners in Italy.

Scammers are sending physical letters straight to customer homes. These documents falsely claim that the user's device suffers from a critical firmware vulnerability.

Physical mail scams are unusual in the digital asset space. Cybercriminals are using real personal information to make these fake warnings seem authentic.

Inside the Scam: Personalized QR Codes and Counterfeit Websites

The fraudulent letters are personalized to deceive recipients. Each letter contains the customer's full name, home address, and specific order details.

Letters also feature a personalized QR code. Scanning the code opens a fake SafePal website hosted on Arweave, a decentralized storage network.

The counterfeit website displays the user's accurate order information on screen, making the phishing attempt look legitimate.

How Customer Data Was Exposed

This physical phishing campaign traces back to a customer data breach disclosed by SafePal in August.

A flaw in an order-tracking plugin exposed customer information for purchases made between March 2025 and April 2026.

The incident affected 39,798 SafePal customers. Compromised data included full names, email addresses, delivery locations, and order logs.

SafePal emphasized that private keys and seed recovery phrases were never exposed. Your stored crypto assets remain safe unless secrets are shared manually.

SafePal Security Audits and Anti-Phishing Measures

SafePal patched the order-tracking plugin vulnerability after identifying the security flaw.

On October 30, security firm Cure53 finished an independent audit of SafePal's systems and confirmed no remaining system vulnerabilities.

SafePal partnered with cybersecurity group Phishfort to detect fake websites and take down malicious domains.

Other hardware wallet providers have faced similar targeting recently. Brands like Ledger, Trezor, and Coldcard have also seen phishing attacks targeting their users.

What to Do If You Receive a Fake Security Letter

SafePal advises customers to remain cautious and take the following steps if targeted by this scam:

• Do not scan QR codes printed on unexpected physical letters.
• Avoid opening web addresses listed in unverified security warnings.
• Never enter your seed recovery phrase into any digital app or website.
• Report physical phishing attempts to local law enforcement.
• Submit scam reports to SafePal's official security team to help take down fake sites.

Protecting Your Assets Against Offline Social Engineering

Hardware wallets protect private keys from online hackers. Because attackers cannot break hardware encryption easily, they attempt to trick wallet owners instead.

Hardware wallet manufacturers will never ask for your recovery phrase or send paper letters asking you to update firmware via QR codes. Always verify security updates through official app channels.