Between March 2025 and April 2026, a flaw in the plugin SafePal used to track orders exposed the names, emails and home addresses of nearly 40,000 hardware wallet buyers. That data is now being used in physical phishing letters sent to Italian SafePal customers.

The letters are printed on quality paper and claim a firmware security issue was found in already shipped wallets. A QR code at the bottom leads through an Arweave link to a fake SafePal site, which shows each victim's real name, address and order details.

Every link in the letters is personalized with the recipient's order data, making the scam far harder to spot than generic phishing.

SafePal has confirmed that phishing attempts using the leaked data have been ongoing for some time. Nothing in the letters is genuine: recipients should discard them and report the attempt to SafePal and the police.