Why Bitcoin Attracts Scammers
Scammers go where the money moves quickly and cannot be reversed. Bitcoin payments settle in minutes, cross borders without a bank, and are final once confirmed. Those are useful properties for an honest payment, and they are the same properties a thief relies on, because no chargeback, court order, or support ticket can pull the funds back after they are sent.
Those same properties explain why almost no bitcoin scam attacks the protocol. The protocol works as designed. The attack targets the person: a convincing story, a fake screen, a sense of urgency, or a moment of trust. The FBI Internet Crime Complaint Center recorded 149,686 complaints referencing cryptocurrency in 2024, with reported losses of $9.3 billion, part of a record $16.6 billion in total reported losses across all complaint types that year (FBI IC3 2024 Annual Report).
The strongest defense is structural. When you understand how each scam works and you hold your own bitcoin in self-custody, most of these attacks have nowhere to land.
Fake Giveaways and Impersonation
The "send one, get two back" giveaway is the most common bitcoin scam by volume. A post or video, often using the name and face of a public figure such as Elon Musk or a major company, promises to double any bitcoin you send to a posted address. No one gives away money at a guaranteed multiple. Every coin sent to that address is gone.
These campaigns lean on hijacked or impersonated accounts, deepfaked livestreams, and reply-spam under legitimate posts. The address shown is controlled by the scammer, and because Bitcoin payments are final, there is no recovery once you send.
How to Spot It
- Guaranteed multiple. Any "double your bitcoin" or "send X get 2X" offer is a scam, without exception.
- Borrowed authority. A celebrity, exchange, or brand name attached to a giveaway, especially in a livestream or reply, is impersonation.
- One-way address. You are asked to send first. A real airdrop or promotion never requires you to send funds to receive funds.
- Urgency. A countdown timer or "first 100 people only" framing exists to stop you from thinking.
Romance and Pig-Butchering Scams
Romance scams, often called "pig butchering," are among the costliest by total loss. The scammer builds a relationship over weeks or months through a dating app, social media, or a wrong-number text that turns friendly. Once trust is established, the conversation turns to an investment opportunity: a special trading platform, a mining pool, or a tip from an "uncle in finance."
The victim is walked through depositing bitcoin into a site that shows fake profits climbing. Small withdrawals may even work at first, to build confidence. When the victim tries to withdraw the full balance, the site demands "taxes" or "fees" first, then disappears. The platform was never real, and the displayed balance was a number on a screen the scammer controlled.
How to Spot It
- Romance plus money. Any new online relationship that turns toward investing is the pattern, regardless of how genuine it feels.
- An exclusive platform. A trading or mining site only your contact can introduce you to does not exist for honest reasons.
- Profits that only climb. A dashboard showing steady, large gains is a display the scammer controls, not a market.
- Fees to withdraw. Being asked to pay taxes or unlock fees before you can withdraw is the moment the trap closes.
Fake Exchanges and Wallet Apps
Scammers clone real exchanges and wallets. A fake site copies the design of a known brand at a near-identical URL, or a malicious app reaches an app store with a familiar logo and a few fake five-star reviews. You deposit funds or enter your credentials, and the operator drains the account.
The most dangerous variant is a fake wallet app that asks you to "import" an existing wallet by typing your private key or recovery phrase. The moment those words are entered, the scammer has full control of every account they unlock.
How to Spot It
- Look-alike URLs. Check the domain character by character. Scammers register addresses that swap a letter or add a word.
- Unofficial download links. Install wallets only from the project's official site or a verified app-store listing, never from a link in a chat, email, or ad.
- Recovery-phrase import into a new app. Be cautious about entering an existing recovery phrase into unfamiliar software. Use wallets with a verifiable track record and open-source code.
- Pressure to deposit. A new platform pushing you to fund an account quickly is a warning sign.
Phishing for Your Recovery Phrase
Your recovery phrase is the master key to your bitcoin. Anyone who has it can move every coin it controls, from anywhere, with no further check. That makes it the single most valuable target in Bitcoin.
Phishing attacks try to capture that phrase. A common version is a fake "wallet validation" or "security update" email with a link to a site that looks like your wallet and asks you to enter your phrase to "verify" or "sync." Another version is a counterfeit hardware-wallet support page that walks you through "re-entering" your backup. Every one of these is a theft in progress.
How to Spot It
- Any request for the phrase. A wallet, exchange, support agent, or "verification" step asking for your recovery phrase is always fraud.
- Manufactured urgency. "Your wallet will be locked," "verify within 24 hours," or "suspicious activity detected" are pressure tactics.
- Link mismatch. Hover a link before clicking. A display name and the real destination that disagree is phishing.
Fake Support Scams
When something goes wrong with a wallet or exchange, people search for help, and scammers are waiting. Fake support appears as sponsored search ads, lookalike accounts replying to your public complaint, or fake phone numbers posted in forums. The "agent" is friendly, technical, and eager to fix your problem, then asks for remote access to your computer, your login credentials, or your recovery phrase.
Self-custody changes the shape of this attack. With a self-custodial wallet, there is no support agent who can move your funds, because no company holds your keys. That cuts both ways: real support can help you with the software, but no one, legitimate or not, can authorize a transaction for you. Understanding the difference between custodial and self-custodial wallets tells you exactly who can and cannot touch your bitcoin.
How to Spot It
- Support that contacts you first. Real support responds to your ticket. It does not slide into your direct messages or call you out of the blue.
- Requests for access or secrets. No legitimate agent needs remote control of your device, your password, or your recovery phrase.
- Sponsored search results. Scammers buy ads above the real site. Navigate to the official domain directly rather than clicking an ad.
Ponzi Schemes and "Guaranteed Returns"
Some scams dress up as investment funds, yield programs, or "cloud mining" services promising fixed daily or weekly returns. These are Ponzi schemes: early participants are paid with deposits from later ones, the operation reports impressive numbers to attract more money, and it collapses when new deposits slow. The defining feature is a promised return that does not match any real source of yield.
Bitcoin itself produces no guaranteed yield. It is a volatile asset whose price is set by an open market. Any program promising fixed, guaranteed bitcoin returns is either a Ponzi scheme or a fraud waiting to vanish. A clear-eyed view of what can actually go wrong in Bitcoin starts with the fact that "guaranteed return" is not one of its real properties.
How to Spot It
- Fixed, guaranteed returns. "Earn 1% a day" or "guaranteed 30% a month" describes no honest investment.
- Referral pressure. Programs that pay you to recruit others depend on new deposits to survive.
- Vague mechanics. If no one can clearly explain where the yield comes from, the yield comes from the next victim.
Address Poisoning and Clipboard Malware
This category targets the moment you send a payment. Bitcoin addresses are long strings most people verify only by their first and last characters, and attackers exploit that habit.
Clipboard malware runs quietly on an infected computer or phone, watches for a copied bitcoin address, and silently replaces it with the attacker's address before you paste. You believe you are paying the right recipient, but the funds go to the thief.
Address poisoning sends you a tiny transaction from an address engineered to look like one you have used before, matching its first and last characters. The hope is that you will later copy that poisoned address from your transaction history and reuse it, sending your next payment to the attacker.
How to Spot and Stop It
- Verify the full address. Check every character, or at least several from the start, middle, and end, not only the first and last few.
- Confirm on the device. A hardware wallet shows the destination address on its own screen. If the address on the device does not match what you intended, the payment was tampered with before it reached the device.
- Never reuse from history. Request a fresh address from the recipient each time rather than copying one from a past transaction.
When you confirm the destination on a Jade Plus screen rather than trusting your computer's display, a swapped address shows itself before you approve, because the device displays what it is actually about to sign.
SIM-Swap Attacks
A SIM swap is an account-takeover attack. The scammer convinces your mobile carrier to move your phone number to a SIM card they control, often using personal details gathered from data breaches or earlier phishing. Once they have your number, they intercept the text-message codes that protect your exchange and email accounts, reset passwords, and drain anything reachable.
SIM swaps target accounts that rely on SMS two-factor authentication, because a phone number is not a secure second factor. The defense is to remove SMS from the path wherever possible.
How to Reduce the Risk
- Drop SMS two-factor. Use an authenticator app or a hardware security key instead of text-message codes on exchange and email accounts.
- Set a carrier port-out PIN. Most carriers let you add a passcode that blocks number transfers without it.
- Move to self-custody. Bitcoin you hold yourself is protected by keys, not by a phone number, so a SIM swap cannot reach it.
Rug Pulls
A rug pull is a scam built around a brand-new token or project. Promoters hype a coin, often with a celebrity tie-in or a flashy roadmap, sell it to enthusiastic buyers, then withdraw the underlying funds and abandon the project, leaving holders with a worthless asset. The "pull" is the moment the creators take the money and walk.
Bitcoin is structurally resistant to this category. It has no founding team that can disappear with a treasury, no marketing company controlling its supply, and a fixed issuance schedule that no insider can change. The thousands of newly minted tokens that fuel rug pulls share none of those properties. Recognizing the difference is part of avoiding common Bitcoin mistakes.
How to Spot It
- A brand-new token with big promises. Heavy hype around a coin that did not exist last month is the setup.
- Anonymous team holding most of the supply. When founders control the float, they can sell into your buying.
- Celebrity or influencer promotion. Paid promotion of a token is marketing, not an endorsement of safety.
The Red-Flag Checklist
Most scams trip at least one of these wires. If you see any of them, stop and verify before sending any bitcoin.
| Red Flag | What It Usually Means |
|---|---|
| Guaranteed or doubled returns | Giveaway scam or Ponzi scheme. No honest investment guarantees profit. |
| Anyone asks for your recovery phrase | Theft. No legitimate service ever needs it. |
| Pressure to act immediately | Urgency is engineered to stop you from thinking or verifying. |
| Unsolicited contact about an investment | Romance scam, fake support, or recruitment into a fraud. |
| Send funds first to receive funds | One-way trap. Legitimate promotions never require this. |
| An "exclusive" platform only your contact can introduce | Pig-butchering investment fraud. |
| Fees or taxes required before you can withdraw | The closing move of a fake-platform scam. |
| A support agent who contacts you first | Impersonation. Real support answers your ticket. |
| An address that does not match on your device screen | Clipboard malware or address poisoning. |
| An offer to recover funds you already lost | A second scam targeting prior victims. |
How Self-Custody Removes Whole Classes of Scams
Structural defense means removing the attack surface, and self-custody with hardware signing does exactly that for several scam categories at once.
No Custodian Means No Account to Drain
Fake support, SIM swaps, and exchange-account phishing all depend on an account that someone else controls and that a "support agent" or password reset can reach. When you hold your own keys, there is no remote account to compromise. No support agent, real or fake, can move your funds, because moving funds requires the key on your device. The first step many people take here is to store their bitcoin safely in self-custody rather than leaving it on an exchange.
Verify-on-Device Defeats Address Swaps
Clipboard malware and address poisoning rely on a swapped address slipping past you on a screen the attacker can influence, so the fix is a second screen you can trust. A hardware wallet such as Jade Plus displays the destination address and amount on its own display, and you physically confirm them on the device before anything is signed. If malware altered the address on your computer, the device shows the real destination, and the mismatch stops you before you approve.
Your Recovery Phrase Never Touches the Internet
The single most valuable secret, the recovery phrase, is generated and stored on a device that need never connect to the internet. Kept in cold storage and never typed into any website, it is out of reach of every phishing page ever built. The Blockstream app paired with a Jade hardware wallet keeps signing on the device and the phrase offline, so the keys that matter never appear on an internet-connected screen.
None of this makes you immune to a convincing story. A self-custody user can still be talked into sending bitcoin to a scammer's address, because the protocol will faithfully execute a payment you authorize. What self-custody removes is the entire category of attacks that work by reaching an account someone else holds for you.
What to Do If You Are Targeted or Victimized
If something feels off, the right move is to slow down. Scams depend on speed, so pausing is itself a defense.
If You Are Still Being Targeted
- Stop communicating. Do not send funds, share secrets, or grant access. Disengage.
- Verify independently. Contact the real company through its official website, typed directly, not through any link or number the other party gave you.
- Assume urgency is a tactic. A real opportunity survives you taking a day to check it. A scam does not.
If You Have Already Sent Bitcoin
Bitcoin transactions are final and cannot be reversed, so funds sent to a scammer cannot be clawed back. The right actions limit further damage and create a record:
- Secure your accounts. If you shared a password or recovery phrase, move any remaining funds to a new wallet with a freshly generated recovery phrase immediately, and change exposed passwords.
- Record the evidence. Save the transaction ID, the addresses involved, screenshots, usernames, and any contact details. A block explorer such as Blockstream Explorer lets you look up the transaction and confirm the addresses and amounts.
- Report it. File a report with the FTC at reportfraud.ftc.gov and the FBI Internet Crime Complaint Center at ic3.gov. These reports feed law-enforcement investigations and the fraud-loss data that warns others.
- Ignore recovery offers. Anyone who contacts you promising to recover lost funds for a fee is running a second scam aimed at people who were just defrauded.
For more on the broader risk picture and how to harden your setup, see what can actually go wrong in Bitcoin and the FTC's consumer guidance on cryptocurrency and scams. General security hygiene, including how to recognize phishing, is covered well by CISA's guidance on social engineering and phishing.
Frequently Asked Questions
How do I know if a bitcoin offer is a scam?
Treat any unsolicited offer as a scam by default. The clearest signals are a promise of guaranteed or doubled returns, pressure to act fast, a request for your recovery phrase, and a stranger who moves the conversation to a private app. No legitimate service guarantees profit or ever needs your recovery phrase.
Can someone steal my bitcoin if they have my address?
No. A bitcoin address only lets someone send you funds or view your public transaction history. Spending requires the private key, which never leaves your wallet. Sharing an address is safe. What is not safe is sharing your recovery phrase or private key, which together grant full control of your funds.
What should I do if I sent bitcoin to a scammer?
Bitcoin transactions are final and cannot be reversed, so the funds cannot be clawed back. Report the theft to the FTC at reportfraud.ftc.gov and to the FBI Internet Crime Complaint Center at ic3.gov, record the transaction ID and addresses, and ignore any follow-up offer to recover your money, which is a second scam.
Will Blockstream or any exchange ever ask for my recovery phrase?
Never. No legitimate company, support agent, wallet, or exchange will ever ask for your recovery phrase, private key, or PIN. Anyone who does is a scammer. Your recovery phrase is entered only into your own wallet when you set it up or restore it, never into a website, chat, or form.
Why do scammers prefer to be paid in bitcoin?
Scammers exploit the same properties that make bitcoin useful: payments settle quickly and cannot be reversed by a bank or court. The scam is the lie that convinces a victim to send funds, not the bitcoin itself. Holding your own keys removes the support-agent and account-freeze attack surface entirely.