Fake SafePal Letters in Italy Use Real Order Data to Bait Wallet Users

SafePal has disclosed unauthorized access to order information for roughly 39,798 customers, after counterfeit letters targeting hardware wallet users in Italy surfaced carrying recipients' real names, addresses and order details.

The company confirmed the affected orders were placed between March 2, 2025 and April 11, 2026. Those dates define the exposure window. The letters themselves are the attack's delivery vehicle, not the breach.

What do the fake letters actually do?

They tell a frightening story. Recipients in Italy have received printed notices claiming their SafePal hardware wallet contains a firmware security flaw. Each letter includes a QR code. Scanning it routes the victim through Arweave, the decentralized storage network, to a counterfeit SafePal website.

The fake site mirrors the letter's claim. Both display the recipient's genuine name, home address and order information. That personal detail is the hook. A scam that already knows what you bought, and when, looks official in a way a generic phishing email never can.

SafePal traced the leak to an authorization flaw in an order-tracking plug-in. The flaw allowed someone to pull order records for customers in the exposure window. The company said it received a phishing report in early May consistent with the issue, then identified the root cause.

What does this change for affected customers?

SafePal has warned that the accessed information may be used in phishing attacks. The practical risk is not the wallet firmware itself. Hardware wallets do not expose private keys through a printed letter or a website visit. The risk is social engineering: a convincingly personalized message pushing users toward a fake domain where they might enter a seed phrase or connect a device.

Customers who ordered a SafePal device between March 2, 2025 and April 11, 2026 should treat any letter, email or site referencing their order as suspect until verified through official channels. QR codes in unsolicited mail deserve particular suspicion, since Arweave-hosted content gives the fake site a decentralized, hard-to-takedown home.

Why this attack pattern matters

Using a data breach to power physical-mail phishing is a step up in sophistication from spray-and-pray email scams. The attacker spent effort on printing and postage, which signals they expect returns. Personalized order data removes the main defense users rely on: the instinct that "real companies know my details, scammers don't."

For SafePal, the operational consequences are twofold. It must close the plug-in's authorization gap and manage reputational fallout from a breach that originated in its own order pipeline, even though the counterfeit firmware-flaw claim is false.

Expect the company to detail remediation steps for the 39,798 affected orders, and expect copycat campaigns to reuse the same breached dataset across other channels until that data loses its value.