Fake SafePal Firmware Letters Target Users in Italy With QR Codes

Some SafePal users in Italy have received counterfeit letters claiming their hardware wallets have a firmware security flaw. The notices include QR codes that route recipients through Arweave to a fake SafePal website. Both the letters and site display recipients’ real names, addresses and order information.

SafePal disclosed unauthorized access to order information for about 39,798 customers with orders placed from March 2, 2025, through April 11, 2026. Those dates identify the affected orders. The company traced the issue to an authorization flaw in an order-tracking plug-in.

SafePal said it received an early-May phishing report consistent with the issue and later identified the root cause. It warned that the accessed information may be used in phishing attacks.