SafePal warns Italian customers over fake firmware letters with QR codes

Letters with real order details

SafePal customers in Italy are receiving fraudulent letters that warn of a serious security flaw in their hardware wallet's firmware, the company said. The letters are sent to home addresses and include personalized QR codes, according to reports cited by Bitcoin.com News.

The mail carries accurate customer details, including full name, home address and specific order information. SafePal said the letters are part of a wave of physical phishing tied to a data breach it disclosed in August.

Scanning the QR code takes the recipient to a counterfeit SafePal website hosted on Arweave, a decentralized storage network, according to local media. The fake site also displays the recipient's order details, which makes the scam look more credible.

Where the data came from

The campaign is linked to an earlier incident involving customers who placed orders between March 2025 and April 2026. A vulnerability in an order-tracking plugin exposed the personal information of nearly 40,000 SafePal customers, including names, email addresses, physical addresses and order details.

SafePal said private keys and recovery phrases were not compromised. Threat actors have been using the leaked customer information for increasingly elaborate impersonation attempts, according to the report.

The phishing campaign comes as attacks on hardware wallet makers rise. Trezor, Ledger and Coldcard have also faced recent cyberattacks, the report said.

What SafePal advises

SafePal said on 30 October that an independent security audit found no vulnerabilities in the systems it reviewed. The company urged affected customers to throw the letters away without scanning the QR code or visiting the linked site.

It also encouraged recipients to report the letters to local law enforcement and to SafePal. The company has not said how many letters were sent or whether other countries are affected.