SafePal Scam Letters Target Italian Customers in 39,798-Record Breach
Key Takeaways
- •Fraudulent SafePal letters have been mailed to Italian customers' home addresses using personal data taken from an August data incident that affected 39,798 records.
- •The letters falsely claim that recipients' devices contain firmware defects, whereas hardware wallet vendors announce firmware updates only through official channels such as companion apps or their websites.
- •The scheme targets individuals rather than devices because hardware wallet users hold their own keys, meaning whoever obtains a recovery phrase gains full control of the funds it secures.
- •Physical letters represent an escalation beyond email phishing, since mailed documents can appear more official and leaked records can resurface long after the original breach.
- •Recipients are advised to disregard the letters' instructions, never share or enter their recovery phrase on any website, and verify device concerns only through the manufacturer's official support channels.
SafePal Scam Letters Target Italian Customers in 39,798-Record Breach
Scammers have begun mailing counterfeit SafePal letters directly to the home addresses of Italian customers, reusing personal data taken in the hardware wallet maker's August data incident, which affected 39,798 records.
Each letter claims that the recipient's device carries a firmware flaw — a defect in the software embedded on the wallet. The claim does not match how hardware wallet manufacturers handle firmware matters: vendors maintain and distribute firmware updates through their own official channels, typically a companion application or the company website, and do not notify individual users of device defects by postal mail.
SafePal produces hardware wallets — physical devices that keep the private keys controlling cryptocurrency holdings offline, isolated from internet-connected systems. Because these devices are built so that sensitive key material never leaves them, unsolicited postal claims of a firmware defect are inconsistent with standard industry practice for communicating device issues. That architecture also explains why the scheme targets people rather than devices: with users holding their own keys, there is no custodian to reset a password or reverse a transaction, so whoever obtains a recovery phrase gains full control of the funds it backs.
The mailing campaign fits a well-documented pattern in which personal data leaked in a breach is reused for follow-up fraud. Records containing names and home addresses allow scammers to send communications that appear specific and credible to each recipient, and physical letters represent an escalation beyond email phishing because a mailed document can feel more official. Leaked records can also circulate long after the breach that exposed them, which is why follow-up schemes can surface at any point after the original incident. Recipients of such letters are generally advised to disregard the instructions they contain and to verify any device-related concern only through the manufacturer's official support channels. A recovery phrase — the backup that hardware wallets generate so funds can be restored on a replacement device — should never be shared with anyone or entered on any website, as no legitimate firmware update or support process requires it.
This content was first published on COINOTAG: https://en.coinotag.com/safepal-scam-letters-italian-customers-breach
