SafePal Users in Italy Targeted by Phishing Scam Following Data Breach

The hardware wallet manufacturer SafePal has alerted its user base regarding a sophisticated physical phishing campaign targeting customers in Italy. This security threat follows a previous data breach that compromised the personal information of thousands of individuals. Fraudulent physical letters are being sent to home addresses, utilizing QR codes to direct unsuspecting users to malicious websites designed to steal digital assets.

Mechanism of the QR Code Phishing Attack

The attackers are leveraging information obtained from a security incident first disclosed by SafePal in August. The breach affected approximately 39,798 customers, exposing sensitive details such as names, physical addresses, and specific purchase histories. While the company has emphasized that private keys and mnemonic phrases were never compromised during the server breach, the leaked contact information is now being used to facilitate targeted physical mail scams.

• Scammers send physical letters via traditional mail to the victims' registered addresses.
• The letters falsely claim there are urgent firmware security issues requiring immediate action.
• Recipients are prompted to scan a QR code, which redirects them to a cloned phishing site.
• The fraudulent websites attempt to trick users into entering their recovery seeds to "update" their hardware wallets.

Response and Preventative Measures

As of November 12, 2026, SafePal confirmed the reports of these fraudulent letters and has taken proactive steps to mitigate the damage. The company’s security team has successfully identified and deactivated over 30 scam domains associated with this campaign. To prevent future exploits of customer data, SafePal has revised its internal policies regarding information storage.

Hardware wallet security relies on the principle that recovery seeds should never be entered into any digital interface or website, regardless of how authentic the request appears.

To bolster privacy, the company has implemented a new protocol limiting the retention of customer data to a maximum of 90 days. This move aims to ensure that even in the event of a future breach, the volume of historical data available to malicious actors remains minimal.

In conclusion, while SafePal has moved to shut down the infrastructure supporting this scam, users are urged to remain vigilant against social engineering tactics. Security experts reiterate that official hardware wallet providers will never request a user's recovery phrase through a website or a QR code. Customers who receive suspicious mail are advised to contact official support channels and refrain from interacting with any external links or codes provided in the letters.