Bitcoin scams.
How to spot them before they spot you.

Why Bitcoin attracts scams

Irreversible transactions (no chargebacks), pseudonymous (harder to trace), and a large population of new users who do not yet understand the technology. The combination creates an environment where scammers thrive, but every scam follows a predictable pattern once you know what to look for.

Recovery scams

Fake exchanges and platforms

Sites that look like real exchanges, let you "deposit" and watch fake gains, then demand fees to withdraw. The withdrawal never comes. Red flags: unsolicited DM with a link, domain that is not the exact official URL, "guaranteed returns," and withdrawal fees that keep increasing.

Pig butchering

The most devastating scam by dollar volume. Someone builds a genuine-seeming relationship over weeks or months, romantic or platonic, then introduces "an investment opportunity." They share screenshots of fake returns. You invest, see fake gains, invest more. When you try to withdraw, the money is gone. Rule: anyone you met online who steers the conversation toward investments is running this playbook.

Giveaway scams

"Send 1 BTCBitcoin (BTC)The ticker symbol for Bitcoin, used on exchanges and in price quotes.Full definition, get 2 back." Elon Musk never said this. Neither did anyone else. Ever. These run on hacked YouTube channels, fake Twitter accounts, and spoofed livestreams. Nobody is giving away Bitcoin.

Fake wallet apps

Apps that look like Ledger Live, Trezor Suite, or other wallets. They steal your seed phraseSeed phraseA wallet backup written as a list of words, usually 12 or 24, that can recreate the wallet's private keys. In a single-signature wallet, anyone who sees it can take the bitcoin unless a separate passphrase also protects it. Keep it offline and private; recovery may also need the passphrase and wallet setup details.Full definition on entry. Only download from: the manufacturer's official website. coldcard.com, trezor.io, shop.ledger.com. Never from app stores or third-party download sites.

Rug pulls and new coins

"Get in early on the next Bitcoin." There is no next Bitcoin. New coins with big promises and anonymous teams are almost always exit scams. The founders sell their pre-mined tokens into retail demand and disappear. More on why altcoins are not Bitcoin.

Hidden exchange spreads (not a scam, but a hidden cost)

This is a disclosed, legal cost that most comparisons ignore, not a scam in the legal sense. Many retail exchanges advertise a low transaction fee while charging a large spreadSpreadThe gap between two prices or rates. In trading, it is the difference between the price buyers pay (ask) and the price sellers get (bid). Many Bitcoin apps and money-transfer services also build a markup into the price they quote you, a cost on top of the advertised fee even when that fee is $0.Full definition on top of the real market price. The spread is the gap between the global Bitcoin price and the price the exchange quotes you, and it can be larger than the advertised fee.

Address poisoning

The attacker sends a tiny amount of Bitcoin to your wallet from an address that looks almost identical to one you have recently transacted with. They are hoping you will copy that lookalike address from your transaction history the next time you want to send to that person. The attacker's address typically shares the first and last few characters with the real one.

The defense: verify the full address before sending, all 34+ characters, not the first and last few. Better: use the address-book feature in your wallet. Never copy addresses from transaction history.

Fake hardware wallets

Counterfeit Ledger, Trezor, or other hardware wallets sold through Amazon, eBay, or unofficial retailers. Some come with a "pre-configured" seed phrase included in the packaging. When you add funds, the attacker who controls the pre-configured seed phrase sweeps your Bitcoin.

The defense:

• Buy hardware wallets only from the manufacturer's official website.
• For a new wallet, reject a seed supplied by a seller and generate a fresh backup yourself. For restoration, use only the backup from your own existing wallet.^[3][5]
• Creating a new wallet and restoring an existing wallet are different. A new wallet generates its backup on the device; reject words supplied in packaging or by another person. A verified restoration legitimately asks for your own existing backup. For example, Trezor Safe 3 supports on-device recovery initiated in authentic Trezor Suite and confirmed on the physical device. Follow the exact manufacturer procedure for your model, not a support message or search advertisement. No seed phrase, private key or passphrase should be sent to this site, a web form, chat or support agent.^[3][5]

See Hardware Wallets for vendor recommendations and verification steps.

SIM swap attacks

The attacker calls your mobile carrier claiming to be you. They convince the carrier to transfer your phone number to a new SIM card the attacker controls. Now they receive all your SMS messages, including 2FA codes for your exchange accounts. They drain any exchange-held Bitcoin before you realize what happened.

Why it works: mobile carriers have poor identity verification. A persistent attacker with basic personal information, often from public data breaches, can often succeed.

The defense:

• Do not keep significant Bitcoin on exchanges.
• Do not use SMS 2FA for Bitcoin exchanges. Use a hardware security key (YubiKey) or an authenticator app (TOTP), not SMS.
• Set a carrier PIN or port-freeze with your mobile carrier.
• Self-custody eliminates this attack entirely. SIM swaps cannot reach your hardware wallet.

Phishing (the seed-phrase trap)

Fake websites mimicking real Bitcoin services (exchanges, wallets, Ledger, Trezor). Delivered via email, Google ads, or social media. The goal: get you to enter your seed phrase.

Common variants:

• "Ledger security alert" email directing you to verify your device on a fake Ledger site.
• Fake crypto wallet app in the App Store or Google Play that asks for your seed phrase to "import."
• Search-engine ad for "MetaMask download" or "Exodus wallet" pointing to a clone domain.

Never enter a hardware-wallet backup into a website or ordinary computer/phone app. Legitimate software-wallet recovery is different: use only the authentic wallet’s documented recovery flow for that wallet’s own backup. Do not import hardware savings keys into a hot wallet as a casual test. Phoenix, for example, explicitly warns against entering its seed in websites and says support never asks for it.^[3][6]

Exchange failures (not fraud by you, but lost funds either way)

Not user-error scams. The risk of exchange-held Bitcoin being lost when exchanges fail or commit fraud.

Historical examples:

• Mt. Gox (2014): approximately 850,000 BTC lost verify×DON'T TRUST, VERIFYClaim: Mt. Gox lost approximately 850,000 BTC in 2014.Verify at: Mt. Gox bankruptcy trustee site ↗ Source 2 in the list belowRepayment to creditors began in 2024-2025 from recovered coins..
• QuadrigaCX (2019): approximately $190M in customer funds missing after the founder died; the OSC found his fraud, not lost cold-wallet keys, caused most of the shortfall verify×DON'T TRUST, VERIFYClaim: QuadrigaCX owed about 76,000 clients C$215M when it collapsed in 2019; OSC staff found at least C$169M was lost, mostly (about C$115M) through founder Gerald Cotten's fraudulent trading, not through cold-wallet keys lost at his December 2018 death.Verify at: Ontario Securities Commission Report on QuadrigaCX (June 2020) ↗ Source 3 in the list belowThe OSC investigation found most of the missing funds resulted from fraudulent operations, not from keys lost at the founder's death..
• FTX (2022): over $8 billion in customer funds missing at the time of bankruptcy verify×DON'T TRUST, VERIFYClaim: FTX bankruptcy filings document over $8 billion in missing customer funds.Verify at: FTX bankruptcy docket (Kroll) ↗ · DOJ press release on Bankman-Fried verdict ↗ Source 7 in the list belowDOJ secured a guilty verdict on seven counts in November 2023; the bankruptcy estate has documented the scope of missing funds in court filings..
• Celsius, BlockFi, Voyager (2022): customer funds frozen during bankruptcy proceedings; partial repayments years later.

Why exchange failures are structural, not exceptional

An exchange holds customer assets in pooled wallets. The exchange controls the keys. Customers have a contractual claim against the exchange, not direct ownership of specific coins on-chainon-chainA Bitcoin payment recorded directly and permanently on Bitcoin's main public ledger, settled by the network itself rather than through a faster off-network lane.Full definition. When the exchange fails, the path back to your assets runs through bankruptcy court.

An exchange is not a bank in the federally-insured sense. The FDICFederal Deposit Insurance Corporation (FDIC)The US agency that insures bank deposits if a bank fails. The standard insurance amount is $250,000 per depositor, per insured bank, for each account ownership category. Since January 1, 1934, no depositor has lost a penny of insured funds as a result of a failure. Bank money market deposit accounts are covered; stocks, bonds, mutual funds (money market funds too) and crypto are not, even when bought at an insured bank. does not insure crypto holdings at any institution, including bank-affiliated platforms verify×DON'T TRUST, VERIFYClaim: The FDIC does not insure crypto-asset holdings at any institution.Verify at: FDIC insured deposits guide ↗ · FDIC advisory on misrepresentation of FDIC insurance for crypto (2022) ↗ Source 8 in the list belowFDIC insurance covers deposit accounts at insured banks up to $250,000 per depositor per ownership category. It does not extend to crypto assets even when held at an FDIC-insured institution.. SIPCSecurities Investor Protection Corporation (SIPC)When a member brokerage firm fails and customer assets are missing, most customers are protected up to $500,000, including $250,000 for cash. It does not cover a drop in a fund's value or any other market loss, and money market mutual funds count as securities, not cash., which protects securities-account holders against broker failure, also does not cover crypto holdings verify×DON'T TRUST, VERIFYClaim: SIPC does not cover cryptocurrency holdings at any broker.Verify at: SIPC: What SIPC Protects ↗ Source 4 in the list belowSIPC covers securities and cash held in qualified securities accounts. Crypto assets fall outside SIPC's coverage.. Customers of a failed crypto exchange become unsecured creditors, standing behind secured lenders, operating expenses, and other priority claims in the bankruptcy queue. Recoveries vary widely and arrive years after the failure.

The defense: hold on exchanges only what you are actively trading. Self-custody is the only real protection against exchange failure. "Not your keys, not your coins" describes counterparty risk, not ideology.

What will never happen

Bitcoin's cryptography has not been broken. No one will "hack" your wallet by guessing your private keyPrivate keyA secret number that proves the right to spend bitcoin by signing transactions. Most wallets derive their private keys from a seed phrase backup. The phrase is not itself a private key, but it can regenerate them, so unless the wallet also needs a passphrase or other keys, anyone who has it can spend the coins.Full definition. The number of possible keys exceeds the estimated atoms in the Milky Way.

Hardware wallets, strong passwords, and self-custody do not protect you from the behavioral attacks above. Those attacks bypass cryptography by tricking you. What protects you:

• Understanding how the attacks work (this page).
• Never sharing your seed phrase. Not with anyone. Not under any circumstances.
• Not keeping Bitcoin on exchanges.
• Verifying addresses character by character before sending.

The math is secure. The human is the vulnerability.

What to do if you have been scammed

• Stop sending money. Do not pay unsolicited recovery, tax or withdrawal-release demands. Preserve transaction IDs, receiving addresses, screenshots and messages before blocking the scammer.^[1][9]
• Report to the FTC: reportfraud.ftc.gov
• Report to FBI IC3: ic3.gov
• Document everything: screenshots, wallet addresses, transaction IDs, communication logs.

If you want to understand how these scams play out in practice, the mechanics, the psychology, and the aftermath for victims, Coffeezilla (Stephen Findeisen) documents them better than anyone else online.

His investigations are primary-source journalism: recorded calls, leaked documents, on-camera confrontations with the people running the scams. The CryptoZoo series is a good entry point for understanding how celebrity-endorsed crypto projects are constructed and collapsed verify×DON'T TRUST, VERIFYClaim: Coffeezilla published a multi-part CryptoZoo investigation documenting the Logan Paul-associated crypto project.Verify at: youtube.com/@Coffeezilla ↗ Source 5 in the list belowSearch the channel for "CryptoZoo" to find the original three-part series and subsequent updates..

youtube.com/@Coffeezilla ↗