Bitcoin Safety Against Scams and Hacks

Bitcoin network security does not make every wallet or custody arrangement secure. Funds can be stolen through software defects, weak key generation, compromised providers, deception, or physical coercion. An owner can follow ordinary security advice and still be harmed.

The losses are still enormous. Chainalysis pegs 2025 at roughly USD 17 billion in scam losses and USD 3.4 billion in hack losses (2026 Crypto Crime Report; Chainalysis 2026 Scams). Those industry-wide estimates describe different categories of loss; they do not establish that every victim made a preventable mistake.

Understanding the attacks helps you reduce exposure and prepare a response. It cannot guarantee that a device, a provider, or a person will never be compromised.

Hardware and Firmware Failures

Coinkite disclosed a Coldcard seed-generation flaw in July 2026. Attackers could reconstruct affected keys offline, without remotely taking over the wallet. Its advisory covers affected firmware on Mk2/Mk3 and also Mk4/Mk5/Q; model names alone do not determine whether a seed is affected.

As checked September 12, Coinkite has published fixed firmware and a migration guide. Updating firmware does not repair an already affected seed. Check the official scope and exceptions, preserve your recovery material, and follow the migration procedure where required. Chapter 6 explains the wallet-specific checks. Never give a seed phrase, recovery code, or private key to a website or someone offering support.

Wallet Drainer Scams

A wallet drainer is a website that gets you to sign a PSBT (Partially Signed Bitcoin Transaction) that moves your coins to the attacker.

The mechanics are dull and effective. The attacker clones an Ordinals marketplace, an NFT page, or an airdrop claim site. You click "list," "claim," or "verify." The signing prompt looks routine. You approve it without reading the outputs. The PSBT broadcasts and your UTXOs land in the attacker's wallet, sometimes in the same block.

This wave hit hard during the Ordinals and inscription mania of 2023 and 2024. The lure spread through Twitter, Discord, and Telegram, usually pinned to a fake airdrop.

Watch for sites that ask you to connect a wallet for something you never went looking for. Watch for "free token" claims. Anything that requests your seed phrase is a scam by definition. Any prompt asking for unusually broad spending permission is a scam in slow motion.

A useful signing rule: never sign a transaction you cannot read. If the prompt does not tell you exactly which outputs go where, reject it and close the tab.

Phishing Attacks

Phishing means you hand over credentials, seed phrase, or a 2FA code to something the attacker controls.

At the high end it is invisible. You get an email that looks like it came from your exchange. Sender address looks correct. Formatting looks corporate. The link drops you on a login page that mirrors the real one pixel for pixel. The URL is one character off, something like kraken-security.com instead of kraken.com. You log in. The attacker forwards your credentials to the real site in real time and starts a withdrawal before your coffee cools.

At the low end it is a Telegram DM claiming your account is at risk and asking you to verify your seed phrase right now.

Both work. Sophisticated phishing catches careful people often enough that "I would never fall for it" is not a defense.

To reduce phishing risk, type the exchange URL yourself and bookmark it. Never click a login link from an email or message. Where supported, use a security key in FIDO2/WebAuthn or U2F mode. These protocols bind authentication to the genuine site; Yubico's documentation describes their phishing resistance. A key used for one-time passwords does not provide that protection. Secure account recovery and devices still matter.

Fake Wallet Apps and Websites

In 2023 researchers pulled multiple fake Ledger and Trezor apps out of major app stores after they had already collected hundreds, sometimes thousands, of downloads. Every fake worked the same way. Polished interface, "setup" flow, and a screen asking for your seed phrase. Users who typed in a real seed lost the coins within minutes.

The same playbook runs through fake websites. Something like ledger-live-app.io or trezor-wallet.net (neither exists, please do not search for them) buys Google ads, ranks above the real product, and harvests seed phrases.

The rule is short. Download wallet software only from the manufacturer's domain. Ledger lives at ledger.com. Trezor lives at trezor.io. Open-source wallets live in their official GitHub repository. Type the URL by hand. Do not search for it. Search ads have been weaponized often enough that you treat the first result like a stranger offering candy.

If a wallet app asks for your seed phrase during the first-time setup of what should be a fresh device, stop. A new wallet generates a seed. It never asks you to bring one.

Telegram and Social Media Scams

Bitcoin chats on Telegram, Discord, Reddit, and Twitter run on a small set of recycled scams.

Fake admins. Somebody copies an admin's avatar and username, then DMs you offering "support." A real project admin will not DM you about money first.

Fake investment groups. A "read-only" channel posts screenshots of huge profits from a mystery trading platform, then invites you in. The dashboard shows gains that never existed. When you try to withdraw, you hit a "tax payment" wall that does not lift.

Giveaway scams. "Send 0.01 BTC, receive 0.05 BTC back." This has never once been real.

Fake exchange migration. "Your exchange is migrating. Verify your wallet now." The link lands on a phishing page.

The common thread is urgency plus unsolicited contact plus an ask that needs your credentials or your coins first.

Impersonation Scams

In 2024 and 2025 phone-based impersonation went mainstream against crypto holders in Europe and North America. The caller poses as an exchange compliance officer, a regulator, a lawyer. The script always names a problem only you can solve, and only right now. Your account is flagged. Your funds will be seized. A court order is being prepared.

Then comes the ask. Move your coins to a "secure wallet" the caller provides. Read out a code they just texted you (that code is a password reset). Pay a "compliance fee" or lose your account.

No exchange, no regulator, no law enforcement agency calls you and asks you to move funds or share an authentication code. Hang up. Open the exchange yourself through a bookmark and check from there.

Malicious Browser Extensions

Browser extensions for crypto wallets are an attack surface most people underrate. Researchers have pulled fake MetaMask, Phantom, and hardware-wallet companion extensions out of the Chrome and Firefox stores more than once. Some steal the seed phrase directly. Others sit quietly and rewrite addresses on the page when you copy them.

Even legitimate extensions get hijacked. In July 2018 the Hola VPN Chrome extension was compromised and started redirecting MyEtherWallet users to a phishing site (BleepingComputer, July 2018). Google removed it in September 2021. Since then researchers keep finding crypto extensions in the Chrome Web Store that swap addresses or read clipboards, and Google keeps removing them on report.

What works: install extensions only from a link on the product's official site. Keep your extension count near zero. For hardware-wallet companion software like Ledger Live or Trezor Suite, run the desktop app, not a browser extension, whenever you have the choice.

Review the extensions you have every few months. Remove anything you do not use this week. Treat surprise update prompts inside the browser with the same suspicion you would give a stranger handing you a USB stick.

Social Engineering and Pig Butchering

"Pig butchering" is the name for one of the most expensive scam patterns of the last few years. The FBI and Interpol have warned about it repeatedly. Global losses run into the billions.

The operation usually starts in Southeast Asia. The scammer contacts you through a dating app, a LinkedIn message, or a "wrong number" text. They build a real-feeling relationship over weeks. The crypto investment topic enters casually, maybe through a story about returns they made on some platform. Then they offer to help you set up an account.

The platform is theirs. The dashboard shows fabricated gains. They will let your first small withdrawal succeed because that one withdrawal sells the rest. As your balance grows, you try to pull a bigger amount and run into a "tax liability" or "compliance fee." Pay it and a second fee appears. Stop paying and the operator vanishes with everything still in the account.

It works because it is slow. The relationship feels real. The dashboard looks like Coinbase. There is no single obvious lie, only an accumulation.

Signs you are inside one: an investment platform introduced by someone you met online and have never met in person, guaranteed or unusually high returns, withdrawals gated behind new fees, pressure to recruit others, vagueness about who runs the platform or where it is licensed.

If any of that fits, stop sending money today. Run the platform name against the FINMA warning list in Switzerland and the FCA ScamSmart list in the UK. Both are public and searchable.

Clipboard Hijackers

This one is technically trivial and underrated. Malware lands on your computer through a cracked download, a malicious email attachment, or a poisoned installer. It watches your clipboard in silence. The moment it sees a Bitcoin address get copied, it replaces it with the attacker's address.

You paste into your wallet, glance at the first four characters, confirm, and send your coins to a stranger. No popup. No error. The malware never speaks to you.

The fix lives in the verification step. Compare the pasted address against the source character by character before you confirm. On large sends, check a chunk in the middle, not just the ends. Keep the operating system patched. Compare the complete address on the hardware wallet against a trusted recipient source, not only the host computer. This can expose a host-side substitution, provided the wallet and its display are trustworthy; it does not prove the device has no firmware defects.

AI Deepfake Scams

In 2025 and 2026 AI deepfakes became the dominant scam vector in crypto. Chainalysis reports impersonation scams up roughly 1,400% year over year and AI-enabled operations pulling 4.5 times more revenue per campaign than the non-AI version (Chainalysis 2026 Scams). Attackers use cheap voice-cloning and video-synthesis tools to put Elon Musk, Michael Saylor, or your local TV finance personality on a fake livestream that holds up under casual inspection.

The format you see most often is a YouTube livestream of a familiar face announcing a "limited-time Bitcoin matching" giveaway. Send 0.1 BTC to this address, receive 0.2 BTC back. The streams run on compromised channels with hundreds of thousands of real subscribers, with fabricated viewer counts on top to project momentum. Millions of dollars walked into this in 2025.

A nastier variant skips the livestream and uses voice cloning on the phone. The caller sounds like your advisor, your CEO, a family member. They create urgency around moving money in the next hour. Some of these calls now pull from the target's own podcast audio.

How to defuse this. Check the URL of any livestream against the creator's verified channel. A real Saylor or Musk channel does not suddenly host a giveaway. Verify any surprise message through a separate channel you start yourself: a fresh phone call to a known number, a face-to-face check, a Signal message you initiate. No legitimate person, company, or platform has ever run a "send Bitcoin, get double back" promotion. In any form, from any source, that pitch is a scam.

Address Poisoning

Address poisoning exploits a habit most people do not realize they have: copying an address out of their transaction history.

The attacker sends you a dust transaction from an address whose first four and last four characters match one of yours. The middle is different, but the middle is the part nobody checks. Later you go to send funds, scan your history for the destination, copy the look-alike, and broadcast without comparing.

This style took off in 2024 on chains with frequent address reuse and visible histories.

The prevention is one rule. Never copy a destination address out of your transaction history. Pull it from the recipient's receive screen or your own saved address book, then compare the full string before you sign. An on-device address check can help reveal clipboard substitution. Compare the entire address against a trusted source before signing, even if a small test payment succeeded.

Physical Coercion

Offline keys do not protect a person from threats. A US Department of Justice conviction notice documents violent home invasions used to force cryptocurrency transfers. It establishes the risk, not the truth of every recent social-media account or a current attack rate.

Limit public details about your holdings and home, and consider who can discover or reach your recovery material. The Metropolitan Police crypto-crime guide includes advice on protecting devices and avoiding publicity about holdings. Separate signers or locations can reduce dependence on one accessible key, but do not guarantee personal safety and require a tested recovery plan. If threatened, prioritize people's safety and contact emergency services when safe to do so.

Practical Safety Checklist

These habits reduce particular risks; they do not make every loss preventable:

If using a hardware wallet, check its security advisories, verify official firmware, and test recovery. Offline signing reduces exposure to an online computer; hardware and software can still fail.

Back up the recovery material your wallet actually requires; chapter 6 distinguishes seed phrases from Muun's Emergency Kit and Recovery Code. For a seed-phrase wallet, keep protected paper or metal copies in separate locations. Never photograph the seed or put it in a cloud note.

Use a unique strong password for every exchange and crypto service. A password manager handles this for you.

Use FIDO2/WebAuthn or U2F security-key authentication where supported. Otherwise, prefer app-based 2FA to SMS, while remembering that one-time codes can still be phished.

Type exchange and wallet URLs yourself, or use saved bookmarks. Never click a login link from an email, a message, or a search ad.

Verify the download link for any wallet app or extension on the official site before installing.

Remove browser extensions you do not actively use.

Before sending a large amount to a new address, send a small test first and confirm it arrived.

When something feels off about a transaction, a request, or a message, stop and verify through a channel you control.

Risk Note

You cannot reverse a confirmed Bitcoin payment yourself. Investigation, recovery, or an insurance claim may sometimes help, but none guarantees reimbursement. Report theft promptly through official channels and avoid anyone demanding advance fees or recovery secrets. If you use insured custody, understand the policy before a loss; chapter 9 covers coverage conditions and gaps.

Reader Takeaway

• Never send recovery secrets to support or enter them on a website. Restore only through the wallet's authenticated recovery procedure; use on-device entry where supported.
• Verify every URL, every app, every extension against the official source before you trust it.
• Urgency is a manipulation tool. The moment somebody pressures you to act now, slow down.
• Skepticism helps against deception. Firmware checks, recovery planning, and physical security address different risks.

Chapter Summary

• Wallet drainer scams get you to sign a transaction that hands over your coins. Never sign a prompt you cannot read end to end.
• Phishing captures your credentials through fake sites that mirror the real ones. Type URLs yourself and use phishing-resistant FIDO authentication where supported.
• Fake wallet apps and extensions are everywhere. Download only from the manufacturer's domain.
• Pig butchering builds trust over weeks before it extracts money. Any investment platform introduced by someone you met online deserves no benefit of the doubt.
• Clipboard hijackers swap copied Bitcoin addresses silently. Verify the full address after pasting, not just the first and last characters.
• Hardware wallets reduce some risks but can have defects. Follow current advisories, maintain recovery plans, and account for physical coercion.
• Insured custody has contractual limits; neither insurance nor self-custody makes losses impossible.

References

• FBI Internet Crime Complaint Center (IC3): Annual Crypto Fraud Reports 2023 to 2025
• Chainalysis Crypto Crime Report 2024, 2025, and the 2026 update covering 2025 calendar-year data
• FINMA warning list for unauthorized financial services
• FCA ScamSmart: unauthorized firm warnings
• Public alerts from FBI, state regulators, Europol, and cybersecurity firms on wallet drainers, phishing, fake apps, and pig butchering