Safepal Users Face Personalized Hardware-Wallet Phishing Letters

Italian customers of hardware-wallet maker Safepal are reportedly receiving fraudulent physical letters tied to a targeted phishing operation. According to Bitcoin.com, the envelopes arrive at customers’ home addresses and contain personalized QR codes paired with false warnings about firmware security, suggesting that information associated with affected users may have been compromised before the mail was sent. The supplied coverage does not provide independent confirmation of the Safepal campaign from a second outlet. The Coin Republic’s summary focuses instead on Bitget Wallet, describing a separate expansion of artificial-intelligence security tools and increased phishing-related signing alerts. The two reports overlap on the broader problem of phishing but do not establish that the same campaign, targets, or figures are involved.

The Bitget Wallet data nevertheless illustrates the scale of phishing-related activity the Safepal letters are entering. The Coin Republic reports that the wallet expanded its AI security tools on Nov. 11, 2026, after phishing-related signing alerts rose 7.4-fold during the third quarter. Weekly flagged interactions increased to approximately 37,000 from 5,000 in Q2, although Chief Operating Officer Alvin Kan said improved detection likely played a role in the higher count.

The broader crypto market was weak during the reported market-data snapshot. Total market capitalization stood at $2.38 trillion, the overall market was broadly down, and Bitcoin fell 4.28% over 24 hours. The Fear & Greed index registered 20, classified as Extreme Fear, while no individual altcoin or token was identified as directly involved in the reported Safepal mailing.

The Safepal letters matter because combining personal details, a physical delivery channel, apparent firmware warnings, and a QR code could make the phishing attempt resemble a legitimate hardware-wallet security notice. The development also highlights that phishing exposure is not confined to conventional online prompts: according to Bitcoin.com, compromised customer data may be helping attackers make unsolicited postal contact appear targeted. Future reporting that identifies the number of recipients, the precise warning text, or whether any QR codes led to credential or signature requests would establish the campaign’s reach and technical mechanics more clearly.