SafePal Scam Letters Target Italian Customers in 39,798-Record Breach

Fake SafePal Letters Reach Italian Homes

Scammers have started mailing counterfeit SafePal letters directly to the home addresses of Italian customers, reusing personal data taken in the hardware wallet maker's August data incident. Each letter claims the recipient's device carries a firmware flaw, meaning a defect in the software embedded on the wallet itself, and instructs the owner to fix it through a QR code printed on the page. That code opens a counterfeit SafePal website hosted on Arweave, a storage network designed to keep files online permanently, which makes the fake page harder to take down than one on ordinary hosting. Both the letter and the site display the customer's real name, postal address and order details, and that precision is what makes the mail convincing. The target is the recovery phrase, the backup words that rebuild a wallet on any device. A holder who types that phrase into the fake site surrenders every coin the wallet holds, since the words alone are enough to restore the balance on an attacker's device. An Italian community account flagged the campaign in a November 12 post on X, describing letters with correct personal data and a personalized link sent to SafePal buyers. SafePal's support team confirmed the operation the same day, Thursday, and connected it to the August breach. The letters “are NOT from SafePal”, the team wrote, adding that wallet infrastructure remains secure and that the firm will never send physical mail or ask for seed phrases. Recipients were asked to report letters through the company's scam-protection page with the QR code visible, so the counterfeit site can be shut down. Unlike a hot wallet that stays connected to the internet, a hardware wallet signs transactions offline, which is exactly why the attackers need the phrase rather than the device.

The August Breach and the Ledger Precedent

The address lists behind the mail trace back to a disclosure SafePal published on August 16. A flaw in an order-tracking plug-in exposed orders placed by 39,798 customers between March 2025 and April 2026, per the company's security update. The plug-in sat on the company's online store and handled shipment tracking, with no connection to the wallets' internal security. Names, email addresses, postal addresses, phone numbers and purchase details leaked. Recovery phrases, private keys and card numbers did not, the company says. SafePal has not said how many letters have gone out or whether recipients outside Italy have received them. Postal addresses do not expire, and this campaign arrives months after the original leak, which suggests the dataset is still in circulation. The pattern is not new. Ledger's 2020 breach leaked postal addresses of roughly 272,000 users, and fake Ledger letters began reaching homes in 2025, five years later. Trezor's shipping partner leaked 13,689 customer records in August of this year, adding a third hardware wallet brand to the list. Neither Trezor nor SafePal has reported a breach of the wallets themselves; in both cases the devices stayed intact and the customer data around them was the exposure. For holders unsure how these devices differ from exchange custody, a primer on how hardware wallets work covers what the device actually signs. The practical line between a cold wallet and an internet-connected account stays the same after incidents like this: the hardware keeps the private key offline, and a data leak only changes who knows where the owner lives.

The record makes one point clear: the wallets were not breached, and the scam pays only if a recipient enters the phrase. SafePal's own statement, the primary document here, says wallet infrastructure remains secure and that the firm will never request a seed phrase by mail. That leaves the exposure where it has sat since August, in the address data, and the defense where it always lands, with the user. Any letter asking for a recovery phrase is a scam by definition, whatever logo it carries, and the funds of anyone who ignores it stay where they were.