SafePal users targeted by mail phishing campaign following customer data leak
Fraudulent physical letters claiming hardware wallets suffer from a firmware flaw are being sent to SafePal customers, directing them to a fake website after a data breach exposed personal records.
Hardware wallet maker SafePal is facing a physical mail phishing campaign targeting its customers, according to reporting from Italian crypto outlet Criptovaluta.it relayed by Wu Blockchain. Fraudulent letters sent to users impersonate the hardware wallet vendor and falsely claim that the recipient's device suffers from a firmware security vulnerability.[3][1][2]
The fraudulent letters include QR codes that route users via Arweave to a counterfeit SafePal website. To increase credibility, both the physical mail and the clone website incorporate accurate customer names, mailing addresses, and order details.[3]
The phishing scheme, which has targeted users in Italy, stems from an earlier data breach. Between March 2025 and April 2026, a flaw in an order-tracking plugin exposed the personal records—including names, email addresses, and physical mailing addresses—of nearly 40,000 SafePal customers. SafePal previously acknowledged that threat actors were actively utilizing the leaked database to stage phishing attacks.[3]
Key facts
- Fraudulent letters impersonating SafePal falsely inform customers that their hardware wallets have a firmware security vulnerability.
- The letters include QR codes directing recipients via Arweave to a fake SafePal website.
- Both the physical letters and the phishing website display accurate customer names, mailing addresses, and order details.
- The mail phishing campaign targets Italian customers, according to Italian media outlet Criptovaluta.it.
- An order-tracking plugin issue exposed personal information of nearly 40,000 SafePal customers between March 2025 and April 2026.
- SafePal had previously confirmed that attackers were leveraging the leaked customer data for phishing operations.
Sources · 3 sources
- SI
Solid Intel 📡@solidintel_xPost on X ·
INTEL: SafePal customers receive fake letters claiming their hardware wallets have a firmware flaw
Open source - CB
Crypto BriefingArticle ·
SafePal users targeted by phishing letters after customer data breach The breach highlights the vulnerability of personal data in e-commerce, leading to sophisticated phishing attacks that exploit user trust. The post SafePal users targeted by phishing letters after customer data breach appeared first on Crypto Briefing .
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
SafePal Users Targeted by Physical Mail Phishing Following Data Breach According to Italian crypto media outlet Criptovaluta it, hardware wallet maker SafePal’s data breach has led to physical mail phishing attacks targeting Italian users. Fraudulent letters impersonating SafePal claim that recipients’ hardware wallets have a firmware security vulnerability and contain QR codes that direct users via Arweave to a fake SafePal website. Both the letters and the phishing website contain accurate customer names, addresses and order details. Between March 2025 and April 2026, an issue with an order-tracking plugin exposed the personal data of nearly 40,000 SafePal customers, including names, email addresses and mailing addresses. SafePal previously confirmed that attackers had been using the leaked data for phishing attempts.
Open source