SafePal users targeted by phishing letters after customer data breach

Crypto phishing usually arrives in your inbox. For some SafePal customers in Italy, it showed up in the mailbox, printed on paper, with a QR code attached.

Attackers are using customer data exposed in a SafePal breach to send fraudulent physical letters. The QR codes on those letters link to phishing sites dressed up as official company communications. The wallets themselves were never compromised.

What happened, and what leaked

SafePal, the hardware wallet maker, disclosed the breach on August 16, 2026. It affected approximately 39,798 customers.

The root cause was an authorization flaw in an order-tracking plugin. Put simply, a tool built to help buyers follow their package was letting the wrong people see order records.

The exposed information included names, email addresses, shipping addresses, phone numbers and purchase details.

The affected orders were placed between March 2, 2025, and April 11, 2026. Anyone who bought a SafePal device in that window had reason to pay attention.

SafePal confirmed that seed phrases, private keys, wallet passwords and financial data were not compromised. Customer funds were not touched by the breach itself.

From leaked data to letters in the mail

After the disclosure, SafePal noted a rise in targeted phishing campaigns. The difference from ordinary spam is that these campaigns use real order data to look credible.

The attacks have taken several forms, including emails, phone calls and physical letters. All of them began by November 2026.

By November 12, 2026, reports indicated that Italian users were receiving fraudulent letters containing accurate personal information. The letters framed themselves as notices about firmware security issues. Each included a QR code pointing to a phishing site.

SafePal confirmed the letters are scams. The company said it has taken down more than 30 fraudulent websites and links tied to the incident.

How SafePal has responded

The company notified affected customers individually by email on August 16, 2026, the same day it disclosed the breach.

It also launched a status-check tool. Customers can enter their order ID and shipping country to see whether their data was exposed.

Beyond notification, SafePal has engaged third-party auditors. It has also limited data retention to 90 days as a preventive measure.

Why a breach without stolen keys still hurts

Hardware wallets exist for one reason: keeping private keys offline and away from attackers. On that front, SafePal’s core product held up.

The weak point was elsewhere. It sat in the ordinary e-commerce plumbing that every hardware company runs to sell and ship devices.

The leaked information enables convincing social-engineering attacks. Fake firmware updates and bogus refund requests are obvious angles. Each one is designed to trick a user into handing over a seed phrase or installing something malicious.

The physical letters add an uncomfortable layer. Many people treat paper mail as more trustworthy than email.

What this means for hardware wallet users

For SafePal customers who ordered in the affected window, the practical risk is not a drained wallet tomorrow. It is a steady stream of well-informed scam attempts that could last for a long time.

Exposed names and addresses do not expire. Unlike a password, you cannot reset where you live.

The safest working assumption is that any unexpected message about firmware, security problems or refunds deserves suspicion, whatever format it arrives in. Firmware should come through official channels the user navigates to directly, not through a link or QR code supplied by a stranger. A legitimate wallet company has no reason to ask for a seed phrase.

SafePal’s move to a 90-day retention limit points in a constructive direction. Data a company no longer holds is data that cannot leak.