Common Bitcoin Scams and How to Avoid Them
Bitcoin scams look endlessly varied and they are not. Sorted by what the attacker actually needs, there are four groups: they want your seed phrase, they want you to send the coins yourself, they want you to sign the wrong transaction, or they want a key you protected badly. Every trick you will meet is a variation inside one of those four, and each group has one defence that covers the whole column.
That framing matters because memorising a list of specific cons is a losing game. New ones appear monthly. The objectives have not changed in a decade.
What do the reported numbers actually say?
Crypto fraud statistics get quoted loosely, so here is one set that comes straight from a primary source and is narrow enough to be meaningful.
In a public service announcement dated 15 May 2026, the FBI's Internet Crime Complaint Center reported 13,460 complaints involving cryptocurrency kiosks during 2025, with losses of $388,981,267. That is 23 percent more complaints and 58 percent higher losses than the previous year. More than half the complaints came from people over 50, and that group accounted for more than $302 million of the total.
The FBI's description of the method is the part worth reading twice. Criminals give victims detailed instructions, including "how to withdraw cash from their bank, how to locate a kiosk," and how to deposit and send the funds. This is not a technical exploit. It is a script, delivered by phone, walking a frightened person through every step.
| Reported by IC3 for 2025 | Figure | Change on 2024 |
|---|---|---|
| Kiosk-related complaints | 13,460 | up 23% |
| Reported losses | $388,981,267 | up 58% |
| Share of complaints from people over 50 | more than half | losses over $302m |
| Texas | $56.8m across 1,179 complaints | highest losses |
| Florida | $32.8m across 1,213 complaints | most complaints of the top three |
| California | $24.0m across 978 complaints | third by losses |
The ones that want your seed phrase
This column has the cleanest defence in the whole article, so learn it once: the words never leave paper. Not into a phone, not into a website, not into a chat, not into a photo, not into a password manager, not to a person on the telephone.
Everything in this group is an attempt to get you to break that rule with a plausible reason attached. A support agent who needs to "verify" your wallet. A tool that will "check whether your phrase is valid." A wallet update that requires "re-entering your recovery words." A cloud backup that would be so much safer. A cloned app in a store, with reviews, that looks exactly like the real one.
The reason the rule works is that no legitimate process ever requires it. Your wallet already knows your seed; it does not need you to type it in unless you are restoring on a fresh device, and you will know when that is happening because you are the one doing it. There is no support case, no verification, no update and no giveaway that needs your words. Anyone asking is an attacker, and there is no exception to check for.
The ones where you send the coins yourself
These are the biggest by value and they are not technical at all. They are confidence tricks that use Bitcoin because Bitcoin does not do chargebacks.
- Long-con investment relationships. Weeks or months of ordinary friendly contact, then a platform showing your deposits growing beautifully, then a withdrawal fee, then a tax, then a compliance hold. The platform is a web page. The balance is a number the scammer types in.
- Authority impersonation at a kiosk. The police, the tax office, the utility, your bank's fraud team. There is a warrant, an unpaid bill, a compromised account, and the only way to fix it is cash into a machine right now. This is the script behind the IC3 numbers above.
- Send one, get two back. A stream, a hacked verified account, a name you recognise. Still going, still working, still absurd.
- Recovery services. The cruellest tier, because it targets people who have already lost money and are therefore known to be both desperate and gullible about crypto. No private company can reverse a Bitcoin transaction. Nobody can. Anyone charging an upfront fee to recover stolen or lost coins is running the second scam of the day on the same victim.
One rule handles this entire column: no real institution is ever paid in bitcoin at a kiosk. Not police, not courts, not tax authorities, not utilities, not your bank, not Microsoft support, not the electricity company. If someone claiming authority wants payment in bitcoin, that alone is proof of fraud, before you check anything else.
If an older relative is anywhere near this world, that one sentence is worth more than any technical advice in this article. Say it to them plainly, and say it before anything happens rather than after.
Address poisoning and the copy-paste attack
Now the technical column, and it is the one that catches careful people.
Nobody reads a full Bitcoin address. Everyone checks the first few characters and the last few, and attackers have built an entire industry on that habit. They generate keys until they find an address matching your first and last characters, then send you a tiny payment so their lookalike appears in your own transaction history, sitting a row away from the real one. Weeks later you copy an address from that history, glance at both ends, and they match.
The scale is worth knowing because it explains the economics. Chainalysis documented a single campaign that generated 82,031 fake addresses, of which only 22 ever received more than $100 from anyone other than the attacker. A vanishingly low hit rate is fine when generating another address costs nothing. In the campaign's biggest success, in May 2024, a target sent roughly $68 million in wrapped Bitcoin to the wrong address. The attacker returned it six days later and still kept about $3 million from price appreciation while holding it, which Chainalysis put at 3,727 times the median scam profit that year.
That case ran on Ethereum rather than Bitcoin, and the return of the funds was extraordinary and should not be expected. The mechanism, though, is identical on Bitcoin, and Bitcoin has no mechanism for giving anything back.
Three defences, in order of how much they buy you:
- Never copy an address out of your transaction history. Get it fresh from the recipient every time. This single habit defeats the attack completely.
- Verify the entire string on the hardware wallet's screen. Your computer's display is whatever malware wants it to be; the device's is not. Clipboard-swapping malware exists precisely because people check the screen they are told to check.
- Send a test amount first for anything large. A few thousand satoshis and one confirmation is cheap insurance, and it is the only check that verifies the whole path end to end.
If it helps to know why addresses look the way they do, and why the modern formats have a checksum that catches typos, we covered that in Bitcoin address types explained.
What is a dust attack, and should you care?
Dust is a tiny amount of bitcoin, small enough that spending it would cost more in fees than it is worth. Bitcoin Core makes that precise: an output below the dust threshold will not be relayed, and the threshold is 546 satoshis for a legacy output or 294 satoshis for a native SegWit one at the default relay rate of 3000 sat/kvB. The difference exists because a SegWit output is cheaper to spend.
A dust attack sprays amounts just above that line across many addresses, then waits. It is a privacy attack, not a theft, and this is the part that gets misreported: receiving dust cannot hurt you. Nobody can take coins by sending you coins.
The damage happens when your wallet, choosing inputs automatically, sweeps two or more dusted outputs into a single payment. Because every input of a transaction is signed by the same owner, that spend publishes a permanent proof that those addresses belong to one wallet. Clusters that an observer could not previously connect are now merged, in every copy of the blockchain, forever.
The defence is coin control, which any serious wallet offers. Find the dust, mark it as do not spend, and forget about it. Do not try to send it back; that is a spend, and it does the exact damage you were avoiding. And if your wallet has no coin control feature, that is a reason to look at a different wallet rather than a reason to accept the exposure.
Why brain wallets are a trap
A brain wallet derives a private key from a passphrase you memorise, usually by hashing it. The appeal is obvious: nothing to lose, nothing to burn, nothing to find in a search. Cross a border with your entire savings in your head.
It does not work, and the reason is structural. Anyone can guess passphrases offline, at whatever speed their hardware allows, with no rate limiting and no possibility of you noticing. Compare that with a hardware wallet, where a wrong PIN locks the device after a handful of attempts. A brain wallet gives an attacker unlimited free attempts against a phrase chosen by a human brain, and human brains are famously bad sources of entropy.
This was measured rather than theorised. In a study presented at Financial Cryptography 2016, Vasek, Bonneau, Castellucci, Keith and Moore carried out the first large-scale measurement of brain wallet use, and found a dozen or so automated "drainers" competing to empty them "as soon as they are funded." Not eventually. As soon as they are funded. Song lyrics, Bible verses, famous quotations and passwords from breach dumps had all been pre-computed by people waiting for someone to use them.
If you want something memorised, the right approach is the reverse: let the wallet generate real entropy per BIP-39, back the words up physically, and if you need a memorised element, add a passphrase on top of a properly generated seed. That way a guessed passphrase alone gets an attacker nothing, because they still need the words.
The tells, and what to do in the first hour
| Scam | The tell | The defence |
|---|---|---|
| Fake support, seed checkers | anyone at all asking for your words | the words never leave paper |
| Authority impersonation, kiosks | an institution wanting payment in bitcoin | no real institution ever is |
| Investment relationship | a platform that shows profits but blocks withdrawal | withdraw early and small, before depositing more |
| Giveaway, doubling | send first, receive more back | this has never once been real |
| Recovery service | upfront fee to reverse a transaction | no one can reverse a Bitcoin transaction |
| Address poisoning | an address in your history you did not add | never copy from history, verify on device |
| Clipboard malware | pasted address differs from what you copied | read the full string on the device screen |
| Dust attack | small unexplained incoming amounts | coin control, freeze it, never spend it |
| Brain wallet | a key derived from something you can remember | wallet-generated entropy, always |
| Tampered hardware | a device arriving pre-initialised or with a printed seed | buy direct from the manufacturer only |
Underneath all ten rows sits one shared signature: urgency. Every scam here needs you to act before you think, because thinking is what kills them. Nothing legitimate about Bitcoin expires in ten minutes. There is no deadline on a genuine support case, no closing window on a real investment, and no warrant that is settled with cash in a machine tonight. When something insists you move now, that insistence is the evidence.
If it has already happened, three things, in this order. Move any remaining funds to a wallet with a brand new seed, generated on a device you trust, because if a key was exposed then every address under that seed is exposed. Report it to law enforcement, which is worth doing even though it rarely ends in recovery, because coins sometimes surface at an exchange that can freeze them. And engage nobody who contacts you offering to help, because your details are now on a list of people known to have lost money.
Then do the unglamorous thing that prevents the next one: work out which threats actually apply to you, rather than defending against all of them equally. Our threat model guide covers that, and hardware wallets closes off most of column three and four on their own.
Related on BTCLinks
Sources
- FBI IC3 public service announcement, 15 May 2026. Source of every kiosk figure quoted: 13,460 complaints, $388,981,267 in losses, the 23 and 58 percent increases, the over-50 share and the $302 million associated with it, and the Texas, Florida and California breakdowns. Verified 2026-07-29.
- Bitcoin Core, src/policy/policy.cpp. The GetDustThreshold comment gives 546 satoshis for a legacy output and 294 for P2WPKH at the default 3000 sat/kvB relay rate. Verified 2026-07-29.
- Chainalysis: Anatomy of an Address Poisoning Scam. Source of the 82,031 generated addresses, the 22 that received over $100, the May 2024 case value and its return, the roughly $3 million retained, and the comparison to the 2024 median scam profit. Verified 2026-07-29.
- Vasek, Bonneau, Castellucci, Keith and Moore, "The Bitcoin Brain Drain: Examining the Use and Abuse of Bitcoin Brain Wallets," Financial Cryptography and Data Security 2016. Source of the drainer finding quoted above. Verified 2026-07-29.
- BIP-39: Mnemonic code for generating deterministic keys. The generated-entropy alternative to a brain wallet, and the passphrase mechanism referenced. Verified 2026-07-29.
Some links are affiliate links. As an Amazon Associate we earn from qualifying purchases. Not financial advice. If you believe you have been defrauded, report it to your national law enforcement body.