Scammers are mailing fake SafePal letters to Italian customers’ homes, using names, addresses and order details leaked in a breach that exposed nearly 40,000 buyers of the company’s crypto hardware wallets.
SafePal says its wallets remain secure. The letters target owners instead. Anyone who enters a wallet’s recovery phrase, the backup words that rebuild it on any device, into a fake site hands over every coin it holds.
How the Fake SafePal Letters Work
The letters claim the recipient’s wallet has a firmware flaw, meaning a problem in the software built into the device.
A QR code opens a fake SafePal site hosted on Arweave, a network built to store files permanently. Both the letter and the site show the customer’s real name, address and order details.
SafePal confirmed the scam on X on Thursday and linked it to its August data incident.
“These letters are NOT from SafePal, and wallet infrastructure remains secure. SafePal will never send physical letters or ask for seed phrases,” the team confirmed.
It asked recipients to report letters on its scam-protection page, with the QR code visible so the site can be taken down.
Why Leaked Home Address Keep Paying Off for Scammers
SafePal disclosed on August 16 that a flaw in an order-tracking plug-in exposed orders placed by 39,798 customers between March 2025 and April 2026.
Names, emails, addresses, phone numbers and purchase details leaked. Recovery phrases, private keys and card numbers did not, the company says.
BeInCrypto warned at the time that the SafePal breach exposed addresses, which do not expire.
Ledger customers have seen this before. Its 2020 breach leaked postal addresses of about 272,000 users, and fake Ledger letters arrived in 2025.
Trezor’s shipping partner leaked 13,689 customer records in August. Neither Trezor nor SafePal has reported a breach of the wallets themselves.
