SafePal Data Breach Victims Are Now Getting Scam Letters at Home
Scammers are mailing fake SafePal letters to Italian customers' homes, using personal information leaked in a breach that exposed nearly 40,000 buyers of the crypto hardware wallet company.
The letters claim the recipient's wallet has a firmware flaw and direct them to a fake SafePal site hosted on Arweave, a permanent file storage network. Both the physical letters and the fraudulent websites display the customer's real name, address, and order details, making the scam highly convincing.
Anyone who enters their wallet's recovery phrase—the backup words that rebuild a wallet on any device—into the fake site risks losing all their cryptocurrency holdings. SafePal confirmed the scam on X on Thursday, explicitly stating it is not behind these communications.
Data Breach Origin
SafePal disclosed on August 16 that a flaw in an order-tracking plug-in exposed the personal information of 39,798 customers who made purchases between March 2025 and April 2026. The leaked data included names, emails, addresses, phone numbers, and purchase details, but not recovery phrases, private keys, or card numbers.
These letters are NOT from SafePal, and wallet infrastructure remains secure. SafePal will never send physical letters or ask for seed phrases.
Industry Pattern
This scam follows a pattern seen in the cryptocurrency industry. Ledger customers experienced similar fake letters after a 2020 breach exposed postal addresses of about 272,000 users. Trezor also faced issues when its shipping partner leaked 13,689 customer records in August. Neither SafePal nor Trezor has reported breaches of their actual wallet security.
Related
