Real

SafePal

Based

Create

Order

<h2 id="span-style-color-inherit-font-weight-bolder-span-style-font-size-16px-safepal-phishing-letters-how-exposed-order-data-fuels-qr-code-scams-span-span">SafePal Phishing Letters: How Exposed Order Data Fuels QR Code Scams</h2>
<a href="https://www.coingabbar.com/en/crypto-currency-news/secondfi-phishing-scam-fake-recovery-email-warning" rel="noopener noreferrer nofollow">Scam mail delivered</a> through the post has become part of the fallout from a data exposure at a well-known hardware wallet maker.&nbsp;
Reports from Italy describe SafePal <a href="https://www.coingabbar.com/en/zaif-email-leak-380536-addresses-arara-breach" rel="noopener noreferrer nofollow">phishing letters</a> that claim a device has a firmware flaw and push readers to scan a QR code.&nbsp;
<img alt="Wu Blockchain Data" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/e8KpqeURUKP65fXbsyWchpDqZgB4bPyPaXXlB86V.png" width="300" style="margin-bottom: 10px; margin-left: auto; margin-right: auto; margin-top: 10px" height="662">
Source: <a href="https://x.com/WuBlockchain/status/2120928807049937197" rel="noopener noreferrer nofollow">Wu Blockchain Data</a>
<h3 id="span-span-style-font-size-16px-what-happened-and-who-was-affected-span-span">What Happened and Who Was Affected</h3>
According to the company’s<a href="https://www.safepal.com/en/blog/security-update" rel="noopener noreferrer nofollow">official incident report</a>, the problem was an authorization flaw in the order-tracking plug-in on its online store.&nbsp;
Under certain conditions, the flaw let someone see another customer’s order details.&nbsp;
The team fixed it after discovery and added extra security measures.
<div>
 <table>
 <colgroup>
 <col width="123">
 <col width="463">
 </colgroup>
 <tbody>
 <tr>
 <td>Detail</td>
 <td>Official information</td>
 </tr>
 <tr>
 <td>Orders affected</td>
 <td>Placed between March 2, 2025 and April 11, 2026</td>
 </tr>
 <tr>
 <td>Customers affected</td>
 <td>About 39,798</td>
 </tr>
 <tr>
 <td>Data accessed</td>
 <td>Name, email address, shipping address, phone number and purchase details</td>
 </tr>
 <tr>
 <td>Notification</td>
 <td>Individual emails sent on August 16, 2026</td>
 </tr>
 </tbody>
 </table>
</div>
The company encourages every customer to check their own status independently, since not everyone who ordered was affected.
<h3 id="span-span-style-font-size-16px-what-the-reported-scam-letters-look-like-span-span">What the Reported Scam Letters Look Like</h3>
Reports from Italy say customers there have received paper mail that appears to come from <a href="https://www.coingabbar.com/en/telegram-wallet-vs-tonkeeper-gram" rel="noopener noreferrer nofollow">the wallet maker</a>.&nbsp;
It claims the recipient’s device has a <a href="https://www.coingabbar.com/en/unocoin-security-update-bitgo-eth-transactions-user-funds" rel="noopener noreferrer nofollow">firmware security problem</a> and carries a QR code.&nbsp;
That code reportedly leads, through the Arweave data-storage network, to a fake website.&nbsp;
Both the mail and the fake site are said to show correct customer names, addresses, and order details, which makes them look genuine.
Those details come from media reports. The official pages do not mention Italy or Arweave, so treat them as reported, not confirmed.&nbsp;
What the<a href="https://www.safepal.com/en/scam-protection" rel="noopener noreferrer nofollow">scam-protection page</a> does confirm is the pattern:
<ul>
 <li style="margin-left: 0px; list-style-type: disc">Scammers use false claims such as a serious firmware flaw or a free replacement or refund.</li>
 <li style="margin-left: 0px; list-style-type: disc">The aim is to make people scan QR codes, open phishing links or type in their 24-word recovery phrase.</li>
 <li style="margin-left: 0px; list-style-type: disc"><a href="https://www.coingabbar.com/en/crypto-currency-news/fake-wallet-extension-scam-hits-crypto-users" rel="noopener noreferrer nofollow">Fake wallet</a> devices may also be mailed to trick people into sending funds or entering a seed phrase.</li>
 <li style="margin-left: 0px; list-style-type: disc">The company says it will never send physical letters under any circumstance.</li>
</ul>
That is why SafePal phishing letters deserve attention even for owners outside Italy.
<h3 id="span-span-style-font-size-16px-what-was-and-was-not-exposed-span-span">What Was and Was Not Exposed</h3>
The incident report is clear about what the flaw did not touch. It also says no evidence has been found that wallets or funds were compromised.
<div>
 <table>
 <colgroup>
 <col width="145">
 <col width="434">
 </colgroup>
 <tbody>
 <tr>
 <td>Exposed</td>
 <td>Not exposed</td>
 </tr>
 <tr>
 <td>Name</td>
 <td>Seed phrase</td>
 </tr>
 <tr>
 <td>Email address</td>
 <td>Private keys</td>
 </tr>
 <tr>
 <td>Shipping address</td>
 <td>Wallet password and other credentials</td>
 </tr>
 <tr>
 <td>Phone number</td>
 <td>Bank account details</td>
 </tr>
 <tr>
 <td>Purchase details</td>
 <td>Payment card numbers and government ID numbers</td>
 </tr>
 </tbody>
 </table>
</div>
The risk is not a direct theft of coins. It is that scammers who know your name, address and purchase can make a fake message look convincing.&nbsp;
The company also said it is aware of individuals claiming to own the dataset and offering it for sale.&nbsp;
It could not verify those claims, but it is monitoring for signs that the data has been shared.
<h3 id="span-span-style-font-size-16px-what-the-company-says-it-has-done-span-span">What the Company Says It Has Done</h3>
Based on the official updates, the response so far includes:
<ul>
 <li style="margin-left: 0px; list-style-type: disc">Fixing the flaw and adding security measures.</li>
 <li style="margin-left: 0px; list-style-type: disc">Shortening the retention period for personal order data to 90 days in the affected system, subject to legal requirements.</li>
 <li style="margin-left: 0px; list-style-type: disc">Opening a dedicated support channel for affected customers.</li>
 <li style="margin-left: 0px; list-style-type: disc">Taking down more than 30 fraudulent websites and phishing links, as of the August report.</li>
 <li style="margin-left: 0px; list-style-type: disc">Finishing an independent audit by security firm Cure53, reported in an October 30, 2026 update, which found no security vulnerabilities.</li>
 <li style="margin-left: 0px; list-style-type: disc">Onboarding anti-phishing providers, including Phishfort, to detect fake domains and impersonation.</li>
</ul>
<h3 id="span-span-style-font-size-16px-how-to-protect-yourself-span-span">How to Protect Yourself</h3>
If you receive SafePal phishing letters, the steps below come from the company’s official guidance:
<ol>
 <li>Do not scan the QR code or follow any instructions it gives.</li>
 <li>Never share your seed phrase, private keys or password with anyone, including people claiming to be support.</li>
 <li>Remember the rules: the company says it will not contact you first, will not phone you, and will not mail letters.</li>
 <li>Type the official web address yourself instead of clicking links, because fake domains often change a single letter.</li>
 <li>Report it through the scam-protection page by uploading a photo, and contact local authorities if you worry about your physical safety.</li>
</ol>
If you already typed your seed phrase after such a message, treat that wallet as compromised.&nbsp;
Create a new wallet using a trusted device or the official app, move your remaining assets, and contact official support.
<h3 id="span-span-style-font-size-16px-conclusion-span-span">Conclusion</h3>
To sum up, <a href="https://www.coingabbar.com/en/crypto-currency-news/safepal-data-breach-news" rel="noopener noreferrer nofollow">SafePal phishing letters</a> show how leaked contact details can be used outside the inbox.&nbsp;
The wallet credentials were not exposed, but the details were enough to make scams look real. Check the official incident report and scam-protection page for updates.
<h3 id="span-span-style-font-size-16px-disclaimer-span-span">Disclaimer</h3>
This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.

SafePal Phishing Letters: How a Data Leak Made Fake Mail Look Real

Table of Contents

Coingabbar

Other articles published on Nov 13, 2026

Join our free newsletter for daily crypto updates!