SafePal Phishing Letters: How a Data Leak Made Fake Mail Look Real
SafePal Phishing Letters: How Exposed Order Data Fuels QR Code Scams
Scam mail delivered through the post has become part of the fallout from a data exposure at a well-known hardware wallet maker.
Reports from Italy describe SafePal phishing letters that claim a device has a firmware flaw and push readers to scan a QR code.
Source: Wu Blockchain Data
What Happened and Who Was Affected
According to the company’s official incident report, the problem was an authorization flaw in the order-tracking plug-in on its online store.
Under certain conditions, the flaw let someone see another customer’s order details.
The team fixed it after discovery and added extra security measures.
Detail | Official information |
Orders affected | Placed between March 2, 2025 and April 11, 2026 |
Customers affected | About 39,798 |
Data accessed | Name, email address, shipping address, phone number and purchase details |
Notification | Individual emails sent on August 16, 2026 |
The company encourages every customer to check their own status independently, since not everyone who ordered was affected.
What the Reported Scam Letters Look Like
Reports from Italy say customers there have received paper mail that appears to come from the wallet maker.
It claims the recipient’s device has a firmware security problem and carries a QR code.
That code reportedly leads, through the Arweave data-storage network, to a fake website.
Both the mail and the fake site are said to show correct customer names, addresses, and order details, which makes them look genuine.
Those details come from media reports. The official pages do not mention Italy or Arweave, so treat them as reported, not confirmed.
What the scam-protection page does confirm is the pattern:
Scammers use false claims such as a serious firmware flaw or a free replacement or refund.
The aim is to make people scan QR codes, open phishing links or type in their 24-word recovery phrase.
Fake wallet devices may also be mailed to trick people into sending funds or entering a seed phrase.
The company says it will never send physical letters under any circumstance.
That is why SafePal phishing letters deserve attention even for owners outside Italy.
What Was and Was Not Exposed
The incident report is clear about what the flaw did not touch. It also says no evidence has been found that wallets or funds were compromised.
Exposed | Not exposed |
Name | Seed phrase |
Email address | Private keys |
Shipping address | Wallet password and other credentials |
Phone number | Bank account details |
Purchase details | Payment card numbers and government ID numbers |
The risk is not a direct theft of coins. It is that scammers who know your name, address and purchase can make a fake message look convincing.
The company also said it is aware of individuals claiming to own the dataset and offering it for sale.
It could not verify those claims, but it is monitoring for signs that the data has been shared.
What the Company Says It Has Done
Based on the official updates, the response so far includes:
Fixing the flaw and adding security measures.
Shortening the retention period for personal order data to 90 days in the affected system, subject to legal requirements.
Opening a dedicated support channel for affected customers.
Taking down more than 30 fraudulent websites and phishing links, as of the August report.
Finishing an independent audit by security firm Cure53, reported in an October 30, 2026 update, which found no security vulnerabilities.
Onboarding anti-phishing providers, including Phishfort, to detect fake domains and impersonation.
How to Protect Yourself
If you receive SafePal phishing letters, the steps below come from the company’s official guidance:
Do not scan the QR code or follow any instructions it gives.
Never share your seed phrase, private keys or password with anyone, including people claiming to be support.
Remember the rules: the company says it will not contact you first, will not phone you, and will not mail letters.
Type the official web address yourself instead of clicking links, because fake domains often change a single letter.
Report it through the scam-protection page by uploading a photo, and contact local authorities if you worry about your physical safety.
If you already typed your seed phrase after such a message, treat that wallet as compromised.
Create a new wallet using a trusted device or the official app, move your remaining assets, and contact official support.
Conclusion
To sum up, SafePal phishing letters show how leaked contact details can be used outside the inbox.
The wallet credentials were not exposed, but the details were enough to make scams look real. Check the official incident report and scam-protection page for updates.
Disclaimer
This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.
