SafePal Phishing Letters: How a Data Leak Made Fake Mail Look Real - Coin Gabbar

Scam mail delivered through the post has become part of the fallout from a data exposure at SafePal, a well-known hardware wallet maker. Reports from Italy describe phishing letters that claim recipients' devices have firmware flaws and push them to scan QR codes, which lead to fake websites.

According to the company's official incident report, the problem was an authorization flaw in the order-tracking plug-in on its online store. Under certain conditions, this flaw allowed someone to see another customer's order details. The team fixed it after discovery and added extra security measures.

Scope of the Breach

The incident affected orders placed between March 2, 2025, and April 11, 2026, compromising approximately 39,798 customers. The data accessed included names, email addresses, shipping addresses, phone numbers, and purchase details. The company sent individual notification emails on August 16, 2026, and encourages all customers to check their status independently since not everyone who ordered was affected.

The Phishing Campaign

Reports from Italy indicate customers there have received paper mail appearing to come from SafePal. These letters claim the recipient's device has a firmware security problem and include a QR code that leads through the Arweave data-storage network to a fake website. Both the mail and the fake site display correct customer names, addresses, and order details, making them appear genuine.

The company says it will never send physical letters under any circumstance.

Scammers use false claims such as serious firmware flaws or offers of free replacements or refunds to trick people into scanning QR codes, opening phishing links, or typing their 24-word recovery phrase. Fake wallet devices may also be mailed to victims to trick them into sending funds or entering seed phrases.

What Was and Was Not Exposed

The incident report clearly states that seed phrases, private keys, wallet passwords, and payment details were not exposed. However, the combination of names, addresses, and purchase details was enough to make the phishing scams appear legitimate. The company has also noted reports of individuals claiming to own the dataset and offering it for sale, though these claims remain unverified.

Company Response and Protection

SafePal has fixed the vulnerability, shortened data retention to 90 days, opened dedicated support channels, and taken down over 30 fraudulent websites. An independent audit by Cure53 found no security vulnerabilities, and the company has onboarded anti-phishing providers like Phishfort to detect fake domains.

Customers who receive phishing letters should not scan QR codes or share seed phrases. They should type official website addresses directly, report scams through SafePal's protection page, and contact authorities if concerned about physical safety. Those who have entered their seed phrase should treat their wallet as compromised and create a new one immediately.