Safepal Hardware Wallet Users Receive Fake Security Alerts in the Mail

Fraudulent Letters Exploit Compromised Data to Spread Phishing Scam

Italian customers of cryptocurrency hardware wallet maker Safepal are reportedly receiving fraudulent letters at their home addresses as part of an elaborate phishing campaign linked to a previous customer data breach.

The letters falsely warn recipients of a critical security vulnerability in their Safepal devices’ firmware. To make the scam more convincing, the letters include personalized QR codes and accurate customer details, including recipients’ full names, home addresses and specific order information. The phishing campaign comes amid a recent surge in cyberattacks targeting hardware wallet makers, including Trezor, Ledger and Coldcard.

In a recent update, Safepal said it was aware of “a wave” of physical phishing letters targeting customers affected by the data breach it disclosed in August. The company said the letters typically contain false claims about firmware security vulnerabilities and urged recipients to disregard them.

According to a local report, scanning the QR code directs victims to a counterfeit Safepal website hosted on Arweave, a decentralized storage network. The fraudulent website also displays recipients’ personal order details, lending credibility to the scam.

The phishing campaign is linked to an earlier security incident involving customer orders placed between March 2025 and April 2026. A vulnerability in an order-tracking plugin exposed the personal information of nearly 40,000 Safepal customers, including their names, email addresses, physical addresses and order details.

Although Safepal said private keys and recovery phrases were not compromised, threat actors have reportedly been exploiting the exposed customer information to launch increasingly sophisticated impersonation attacks.

Affected Users Urged to Ignore the Letters and Report

Safepal, which announced Oct. 30 that an independent security audit had found no vulnerabilities in the reviewed system, has urged targeted customers to discard the letters without scanning the QR codes or visiting the linked websites. The company also encouraged recipients to report the phishing attempts to local law enforcement and Safepal’s official scam-protection team to help facilitate the takedown of fraudulent domains.

Since the breach, Safepal has implemented additional security measures, including engaging anti-phishing providers such as Phishfort to help detect and combat fraudulent websites, impersonation attempts and other phishing attacks.

The hardware wallet manufacturer stressed that unauthorized threat actors gained access to the data through a malfunctioning plugin used to…