EL7.AI
CryptoMedium•12 November 2026•
4 min read

Data Leak Affecting About 39,798 SafePal Customers Followed by Email Scam in Italy

Key Facts

1The incident affected about 39,798 customers who placed orders between March 2, 2025 and April 11, 2026.
2The data accessed included names, email addresses, shipping addresses, phone numbers and purchase details.
3SafePal said it found no evidence that wallets or funds were compromised, and that recovery phrases and private keys were not affected.
4Cure53 completed its independent audit on October 30, 2026, and SafePal said it found no vulnerabilities in the systems it reviewed.
5SafePal said it reduced the retention period for personal information in the order-processing environment to 90 days.

SafePal said a permissions flaw in an order-tracking add-on allowed, under certain conditions, unauthorized access to another customer’s order information, in an incident affecting about 39,798 customers who ordered products between March 2, 2025 and April 11, 2026. The company said customer names, email and shipping addresses, phone numbers and purchase details were among the data accessed. In a report published by BeInCrypto on November 12, 2026, the fallout from the leak appeared in Italy in the form of physical letters impersonating SafePal. The letters claim there is a problem with the wallet’s firmware, then direct recipients via a QR code to a fake website displaying their real name, address and order details. SafePal said some customers received letters of this kind, warning that the company does not send letters by post.

According to BeInCrypto’s reporting, the letter uses correct customer data to lend credibility to the claim that there is a problem with the recipient’s device, while the QR code leads to a site impersonating SafePal’s page and hosted on Arweave. The appearance of the person’s name, address and actual order details creates a convincing link between the scam letter and the previous purchase experience, and may lead the recipient to treat it as a genuine support notice. SafePal said the affected information could be used in phishing and impersonation attempts involving calls, text messages and emails, recovery offers, firmware update requests, and malicious websites seeking wallet data. It also warned about messages citing a critical firmware vulnerability or offering a free device replacement or refund to push users toward phishing links. The company recommends not scanning QR codes in unexpected messages and reporting letters impersonating it.

SafePal distinguished the exposure of order data from a compromise of the wallets themselves, saying it had found no evidence that the incident led to wallets or funds being compromised. It added that recovery phrases, private keys, wallet passwords and credentials were not among the information involved in the incident. This means the risk identified by the company in its statement concerns the use of personal and commercial information for impersonation and phishing, rather than any confirmed direct access to the keys controlling assets. The company urged users not to enter a recovery phrase on any site reached through a link or QR code in a message, and to verify information manually through SafePal’s official website. It also said it received a report consistent with the issue in early May, but initially treated it as an isolated case before escalating it to a formal security investigation.

The company said a configuration error halted the scheduled data-cleanup process between September 2025 and April 2026, leaving older records in the order-processing environment. It said it fixed the process and tightened access controls, and reduced the retention period for personal information in that environment to 90 days. It also said it began a full review and rebuild of the order-processing flow in July, and confirmed the issue’s root cause during the investigation. The company said it reviewed logistics and fulfillment partners and had so far found no evidence of an external breach of their data. It retained a secured, offline backup of the specified affected records, which it said was intended to support potential investigations.

In an update dated October 30, 2026, SafePal said an independent Cure53 audit of its e-commerce systems and order-processing flows had been completed and found no security vulnerabilities in the systems it reviewed. The company also said it had identified and removed more than 30 fraudulent websites and phishing links associated with the scam activity, and was continuing to monitor for new sites. It notified affected customers by email on August 16, saying it had brought in additional support staff to respond to their inquiries. It also said it was working with on-chain asset-tracing specialists on financial losses related to the incident, and that information provided by customers could help tracing efforts and assist authorities. SafePal’s own messages remain clear on the practical step: do not scan QR codes in impersonation letters and report them, and treat any request to enter wallet data through a link with suspicion.