Italian customers of cryptocurrency hardware wallet maker Safepal are reportedly receiving fraudulent letters at their home addresses as part of an elaborate phishing campaign linked to a previous customer data breach.

The letters falsely warn recipients of a critical security vulnerability in their Safepal devices’ firmware. To make the scam more convincing, the letters include personalized QR codes and accurate customer details, including recipients’ full names, home addresses and specific order information. The phishing campaign comes amid a recent surge in cyberattacks targeting hardware wallet makers, including Trezor, Ledger and Coldcard.

In a recent update, Safepal said it was aware of “a wave” of physical phishing letters targeting customers affected by the data breach it disclosed in August. The company said the letters typically contain false claims about firmware security vulnerabilities and urged recipients to disregard them.

According to a local report, scanning the QR code directs victims to a counterfeit Safepal website hosted on Arweave, a decentralized storage network. The fraudulent website also displays recipients’ personal order details, lending credibility to the scam.

The phishing campaign is linked to an earlier security incident involving customer orders placed between March 2025 and April 2026. A vulnerability in an order-tracking plugin exposed the personal information of nearly 40,000 Safepal customers, including their names, email addresses, physical addresses and order details.

Although Safepal said private keys and recovery phrases were not compromised, threat actors have reportedly been exploiting the exposed customer information to launch increasingly sophisticated impersonation attacks.

Safepal, which announced Oct. 30 that an independent security audit had found no vulnerabilities in the reviewed system, has urged targeted customers to discard the letters without scanning the QR codes or visiting the linked websites. The company also encouraged recipients to report the phishing attempts to local law enforcement and Safepal’s official scam-protection team to help facilitate the takedown of fraudulent domains.

Since the breach, Safepal has implemented additional security measures, including engaging anti-phishing providers such as Phishfort to help detect and combat fraudulent websites, impersonation attempts and other phishing attacks.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。