WuBlockchain
SafePal customers are receiving physical letters impersonating the hardware wallet maker after a data breach exposed information on nearly 40,000 customers. The letters claim recipients’ devices have a firmware vulnerability and include QR codes that direct users through Arweave to a fake SafePal website.
Why it matters
The exposed data included names, email addresses, mailing addresses and order details between March 2025 and April 2026. That level of specificity makes the campaign more dangerous than a generic phishing attempt because the letters and fraudulent site can reference accurate customer information. SafePal has previously confirmed that attackers were using the leaked data in phishing attempts.
Market impact
The campaign puts SafePal customers at risk of transferring funds or exposing wallet information through a spoofed website. The physical delivery method gives it a credibility advantage over ordinary email phishing, while the leaked order details help scammers appear legitimate. Investors should watch for further reports of affected customers and any response from SafePal.
Source: [SafePal: lettere fisiche di phishing dopo la fuga di dati. Colpiti anche utenti italiani — Criptovaluta.it®](https://www.criptovaluta.it/189491/safepal-phishing-lettera-italia/)
Frequently asked questions
-
How many SafePal customers were affected by the data breach?
Nearly 40,000 SafePal customers had personal data exposed between March 2025 and April 2026 through an order-tracking plugin issue.
-
What information did the SafePal phishing letters contain?
The letters and fake website used accurate customer names, mailing addresses and order details to appear legitimate.
-
What did the fraudulent SafePal letters claim?
They claimed that recipients’ hardware wallets had a firmware security vulnerability and directed users through QR codes to a fake SafePal website via Arweave.
-
Why is physical mail phishing more dangerous than email scams?
A physical letter carrying accurate customer and order information can create more trust than an unsolicited email, increasing the chance that recipients act on the included QR code.
-
Has SafePal confirmed the leaked data was used for phishing?
Yes. SafePal previously confirmed that attackers had been using the exposed customer data for phishing attempts.
TheBlock
Lookonchain
CoinDesk
WatcherGuru
CryptoSlate
CoinTelegraph