Bitcoin puts you in charge of your own money, and that includes its security. There is no fraud department to call. The good news is that the Bitcoin network itself has never been hacked; nearly every loss comes from a person being tricked or careless, and every one of those has a defense.
How people actually lose bitcoin
- Scams. Fake investment platforms, giveaway hoaxes, and romance scams. By dollar value this is by far the biggest category.
- Phishing and fake support. A convincing email, text, or “support agent” gets you to hand over a password, a two-factor code, or a seed phrase.
- Lost seed phrase. A wallet backed up nowhere, or on paper that burned, or in a photo on a phone that was wiped.
- SIM swap. A criminal takes over your phone number and uses it to reset your passwords.
- Exchange failure. The company holding your coins is hacked or goes bankrupt.
- Wrong address. Malware swaps the address you copied, or you paste the wrong one and never check.
First, the hard truth: transactions cannot be reversed
A credit-card charge can be disputed and a bank wire can sometimes be recalled. A confirmed bitcoin transaction cannot. Once it is in a block, no company, court, or developer can undo it. If you send coins to a scammer or to a mistyped address, they are gone.
That is the price of a system nobody controls, and it is why every habit on this page is about stopping a mistake before you tap Send.
Two-factor authentication, done right
Two-factor authentication (2FA) means logging in takes your password plus a second proof, usually a six-digit code that changes every 30 seconds. Turn it on for your exchange account and for the email address attached to it.
Use an authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, or similar) or a hardware security key such as a YubiKey. Do not use text-message codes if the site offers anything else; a phone number can be stolen, as the SIM-swap section explains. When you set up the app, save the backup codes the site gives you somewhere offline.
Two more basics: give the exchange a long, unique password kept in a password manager, and consider a separate email address used only for financial accounts, so a leak of your everyday email does not lead straight to your money.
Phishing and fake support
Phishing is a message that pretends to come from a company you trust. It might be an email saying your account is locked, a text about a “suspicious withdrawal,” or a search ad for your exchange that leads to a lookalike site. The goal is to get you to type your login on their page.
Fake support works the other way around. You post a question on X, Reddit, Discord, or Telegram, and within minutes a friendly “support agent” messages you. They will ask you to “validate” your wallet, share your screen, or enter your seed phrase on a form. Real companies do not send support to your DMs.
- Never log in through a link in an email or text. Type the address yourself or use a bookmark.
- No legitimate person will ever need your seed phrase, your password, or your 2FA code. Not support, not a “tax auditor,” not a “security team.”
- Urgency is the tell. Anything demanding you act in the next few minutes is almost certainly a scam.
Giveaway, investment, and romance scams
These are the two that cost people the most. For the full list, with the warning signs they all share and what to do afterward, see Avoiding Bitcoin Scams.
The “send bitcoin, get double back” scam is at least a decade old and still works. A video or post that looks like it comes from a famous founder or company promises to return twice whatever you send to an address. Nobody has ever gotten anything back. There is no such thing as a giveaway that requires you to pay first.
Far more costly are investment scams, often called “pig butchering.” A stranger befriends you by text, a dating app, or a wrong-number message, builds a relationship over weeks, then introduces a “trading platform” that shows spectacular gains. The gains are fake numbers on a website they control. Every dollar you deposit goes to them, and when you try to withdraw, there is suddenly a “tax” or “fee” to pay first.
The scale is enormous. In its 2025 annual report, published in April 2026, the FBI’s Internet Crime Complaint Center (IC3) counted 181,565 complaints involving cryptocurrency with more than $11.3 billion in reported losses, up 22 percent from 2024 and more than half of all reported cybercrime losses. Investment fraud alone accounted for about $7.2 billion. Those are only the losses people reported.
Warning signs: guaranteed returns, a new online friend who steers the conversation to investing, pressure to move money off a regulated exchange to a platform you have never heard of, and any request to pay a fee to unlock your own funds.
SIM-swap protection
In a SIM swap, a criminal convinces or bribes someone at your mobile carrier to move your phone number to a SIM card they control. Your phone goes dead, and their phone now receives your calls and texts, including password-reset links and SMS 2FA codes. From there they reset your email, then your exchange login.
- Call your carrier and add a port-out PIN or account lock. The major US carriers all offer one.
- Move every financial account off SMS 2FA and onto an authenticator app or security key.
- Remove your phone number as a recovery option for the email account tied to your exchange.
- Do not announce your bitcoin holdings publicly. SIM swappers pick targets.
Verify every address
Clipboard malware is a program that watches for anything that looks like a bitcoin address when you copy it and silently replaces it with the attacker’s address when you paste. You paste, glance, send, and the money goes to a stranger.
The defense is a habit: after pasting, compare the first six and last six characters of the address against the source. If you use a hardware wallet, confirm the address on the device’s own screen, which malware cannot alter. For any large amount, send a small test first.
A related trick is “address poisoning”: a scammer sends you a tiny amount from an address that starts and ends with the same characters as one you use, hoping you will later copy it from your transaction history. Never copy an address from your history. Get it fresh from the recipient.
Withdrawal allowlists
Most major US exchanges let you set up an address allowlist (sometimes called a whitelist): a short list of your own wallet addresses, the only ones the account can withdraw to. Adding a new address usually triggers a waiting period of a day or two and an email confirmation. Some exchanges also let you lock all account settings behind a similar delay.
Turn this on. It means that even if someone gets into your account, they cannot send your bitcoin anywhere but to you, and the delay gives you time to notice.
Put an alarm on your own wallet
If you hold bitcoin in a wallet you rarely open, its balance should never change unless you change it. A wallet-watch alert on your own address tells you within minutes if coins move that you did not move, which is how you learn that a recovery phrase has leaked while there is still time to empty your other wallets. How to set one up, and the privacy trade-off, are in Bitcoin Price Alerts.
If you have been scammed
- Stop sending money, no matter what the other side says. Every “fee to release your funds” is more theft.
- Contact the exchange you sent from right away. If the coins are still on a regulated exchange, or landed on one, the exchange may be able to freeze them.
- File a report with the FBI at ic3.gov. Include transaction IDs, addresses, dates, amounts, and screenshots. Reports are how investigators connect cases.
- Report to the Federal Trade Commission at reportfraud.ftc.gov as well.
- Beware of “recovery services” that promise to get your bitcoin back for an upfront fee. The FBI counted more than 10,000 complaints about these in 2025. They are a second scam aimed at the same victims.
In an emergency
Your seed phrase was seen, photographed, or typed anywhere online: create a brand-new wallet with a new seed and move all your coins to it now, whatever the fee. Treat the old wallet as empty forever.
Your exchange account is acting strangely: lock the account (most exchanges have a one-click lock in security settings or a link in their login emails), change your email password from a different device, check your email for forwarding rules you did not create, and contact the exchange’s support through its website, not through any message you received.
Your phone suddenly has no service: assume a SIM swap. From another device, call your carrier, change your email password, and lock your exchange accounts, in that order.
Your phone or hardware wallet is lost: your coins are safe as long as your seed phrase is. Restore the wallet from the seed on a new device, then move the coins to a fresh wallet if you think anyone could have unlocked the old one.
Next
- Wallets and self-custody: how to hold your own keys, and how to back up a seed phrase properly.
- Bitcoin and taxes: the US basics, including why you should keep records from day one.