Scammers exploit stolen customer information to send convincing physical letters containing malicious QR codes, while SafePal confirms its hardware wallets and private-key infrastructure remain secure. Cryptocurrency wallet provider SafePal has warned customers about a targeted phishing campaign involving fraudulent physical letters sent to users whose personal information was exposed in an earlier data breach. The latest attacks, reported on November 12, 2026, involve customers in Italy receiving letters impersonating official SafePal communications. The documents contain accurate names, residential addresses and purchasing information, making them appear legitimate. According to reports from BeInCrypto and Crypto Briefing, the letters falsely claim that recipients’ hardware wallets contain critical firmware vulnerabilities requiring immediate security updates.
Customers are instructed to scan QR codes directing them to fraudulent websites designed to steal cryptocurrency wallet recovery phrases. SafePal confirmed the campaign and emphasized that the letters were not authorized company communications. The development follows an August 16 disclosure revealing that approximately 39,798 customers had their personal information exposed through a vulnerability in SafePal’s order-processing infrastructure.
Fraudulent Letters Use Leaked Customer Details to Steal Recovery Phrases
The phishing campaign uses personal information obtained through SafePal’s earlier security incident to create convincing communications targeting individual wallet owners. Attackers reportedly include customers’ real names, addresses and order information in the letters, presenting the messages as personalized security notifications. The documents claim that users must address a firmware vulnerability and provide QR codes linking to counterfeit SafePal websites. According to BeInCrypto, some fraudulent pages were hosted using Arweave, a decentralized storage network that allows information to remain accessible independently of conventional website hosting infrastructure.
The attackers’ objective is to persuade customers to enter their recovery phrases, which can provide complete access to cryptocurrency stored in affected wallets. SafePal stated that it never sends physical letters requesting wallet updates or recovery information. The company urged recipients to avoid scanning suspicious QR codes and report fraudulent communications through its official scam-protection portal. Importantly, the phishing campaign does not indicate that SafePal’s hardware wallets themselves have been compromised. The attacks instead rely on social engineering, attempting to deceive users into voluntarily disclosing sensitive credentials.
August Data Breach Exposed 39,798 SafePal Customers
SafePal disclosed on August 16 that an authorization vulnerability in an order-tracking plugin had allowed unauthorized access to customer purchase records. The affected information related to orders placed between March 2, 2025, and April 11, 2026. Compromised records included customer names, email addresses, shipping addresses, telephone numbers and purchase details. However, SafePal confirmed that recovery phrases, private keys, wallet passwords, payment card details and bank account information were not exposed.
The company said it had corrected the vulnerability, strengthened its security controls and introduced a 90-day retention limit for customer order information. SafePal also reported identifying and removing more than 30 fraudulent websites and phishing links associated with the incident. The company has not disclosed a verified financial loss attributable to the latest physical-letter campaign. The incident highlights a growing security concern for hardware wallet providers: customer information stolen from e-commerce systems can facilitate cryptocurrency theft even when wallet technology remains uncompromised. SafePal advised customers who have already disclosed recovery phrases to create new wallets using verified software or devices and transfer any remaining assets immediately.