SafePal customers received emails containing fake malware
SafePal has confirmed an email phishing campaign in which customers, primarily in Italy, received handwritten letters claiming a software vulnerability in their hardware wallet and instructing them to scan a QR code.
11/14/20263 min read
Why are mail scams so effective here?
A letter overcomes barriers that email never does. There are no spam filters, no sender domain to check, no hover link previews, and no habit of suspicion. Most people have been trained over twenty years not to trust surprise emails and lack the same instinct for physical mail, which still carries an undeserved weight from organizations.
Stolen order data is what turns a common scam into a believable one. A letter stating the correct product, the correct purchase date, and the correct shipping address isn't a cold approach. It's a message from someone clearly aware of the purchase the recipient has made, and that's the signal one uses to determine whether a communication is authentic.
The QR code completes it. A printed code that can't be verified before being clicked directs the victim to a phone with a truncated address bar, and to a website that will ask for a recovery phrase under the guise of a software migration. Entering the seed phrase anywhere other than the device itself is the only irreversible act of self-managing data, and just one compelling reason is enough.
A sufficient amount of time to attack.
The leak was revealed in August, with Forbes reporting that 53,487 owners were affected on SafePal and Trezor. The warning letters arrived in November. That timeframe wasn't due to operational delays; it was the time it took for the initial warnings to fade, customers who should have been vigilant to become complacent, and a letter no longer clearly related to the data leak that anyone could remember.
This is a similar pattern to what was seen after the 2020 Ledger database leak, which led to scams, extortion, and physical threats against customers for years afterward, and that's why Keystone's disclosure last month, exposing the information of 25,964 confirmed homebuyers, should be understood as an ongoing incident rather than a resolved issue. Customer data is not erased over time. Lists of people known to hold cryptocurrency, along with their addresses, retain their value indefinitely and are resold.
A costly lesson for suppliers.
The recurring flaw is storage capability. The Keystone data leak stemmed from an automated deletion tool that silently violated the 180-day policy, leaving shipping address data intact for two years. Hardware wallets are designed so customers don't need to trust a third party with their assets, yet the purchasing process requires that third party to be trusted with the necessary information to locate the asset.
A useful standard is that suppliers are not allowed to provide lists of who bought what and where the goods were delivered more than a few months after the transaction is completed. This is a difficult constraint for support and logistics, and it's the only measure that truly limits the damage of a subsequent leak.
Assessment and Conclusion
The practical rules are concise. Hardware wallet firmware is never distributed via mail, QR code, or any other route outside of the provider's own application. No legitimate provider requires a recovery phrase for any reason, including conversion, verification, or security breaches. A letter containing accurate order information is proof that the sender is holding the leaked data, not proof that the sender is the provider.
SafePal's confirmations and warnings are accurate responses, and they won't reach everyone. The 39,798 people on that list will continue to be contacted, via mail, phone, and eventually in person, and the only sustainable defense is the seed phrase rule, which should only be entered on the device and not anywhere else.
Disclaimer: The content in this article is for informational, research, data analysis, and reference purposes only regarding the cryptocurrency market. All opinions, assessments, forecasts, or opinions reflect the author's perspective at the time of publication and do not constitute investment advice, solicitations for buying or selling, trading recommendations, advertising, marketing, or promotion of any financial products, services, or cryptocurrencies. Mentions of projects, tokens, protocols, exchanges, wallets, or cryptocurrency service providers (CASPs) are for research, analysis, or informational purposes only and should not be construed as endorsements, recommendations, or guarantees in any way. HCCVenture does not broker, advertise, market, promote, or connect users in Vietnam with any cryptocurrency services from CASPs. HCCVenture does not accept asset custody, investment mandates, manage assets, or execute transactions on behalf of clients. All investment decisions are made entirely through the reader's own research (DYOR), evaluation, and responsibility; HCCVenture is not liable for any losses or damages arising from the use of or reliance on the information presented in this article.
Compiled and analyzed by HCCVenture
Join our information channels: https://link3.to/holdcoincventure
Explore HCCVenture group
HCCVENTURE QUANT JSCO
© 2026 HCCVENTURE. ALL COPYRIGHTS RESERVED.
Connect with us
Popular content
Contact to us
Address: 8th Floor, Bach Dang Complex Building, 50 Bach Dang Street, Hai Chau Ward, Da Nang City, Vietnam.
Phone: 1900 1509
Gmail : sp_contact@hccventure.com
Disclaimer: The information on this website is for informational purposes only and should not be considered investment advice. We are not responsible for any risks or losses arising from investment decisions based on the content here.
TERMS AND CONDITIONS • CUSTOMER PROTECTION POLICY
ANALYTICAL AND NEWS CONTENT IS COMPILED AND PROVIDED BY EXPERTS IN THE FIELD OF DIGITAL FINANCE AND BLOCKCHAIN BELONGING TO HCCVENTURE ORGANIZATION, INCLUDING OWNERSHIP OF THE CONTENT.
RESPONSIBLE FOR MANAGING ALL CONTENT AND ANALYSIS: HCCVENTURE FOUNDER - TRUONG MINH HUY
Read warnings about scams and phishing emails — REPORT A PROBLEM WITH OUR SITE.
