Phishing, Rug Pulls, and How to Avoid Them
The Concept
Bitcoin itself has never been "hacked" — its cryptography and consensus rules have held since 2009. Nearly every dollar lost in Bitcoin scams is lost to social engineering: tricking a person into handing over access voluntarily, not breaking the protocol. Understanding the handful of recurring patterns covers the large majority of real-world losses newcomers experience.
Phishing sites and messages mimic a real exchange, wallet provider, or support channel to steal login credentials or a seed phrase. Fake "support" accounts on social media reply to public complaints with offers to help, then ask for a seed phrase or remote-access software "to fix the problem" — real support never needs either. Giveaway scams promise to double any Bitcoin sent to a given address, often impersonating celebrities or companies, and rely purely on greed and urgency; there is no mechanism by which sending Bitcoin to an address could ever return more than you sent. Rug pulls are a different category: unrelated token or "DeFi" projects that borrow Bitcoin's credibility and hype to attract investment, then the creators drain the liquidity and disappear, leaving the token worthless — these exploit Bitcoin's reputation without actually being Bitcoin.
A fifth pattern worth naming separately because it targets people who already know better: fake hardware wallet or firmware scams, where a victim receives a "replacement" hardware wallet in the mail (unsolicited, or after a fake support interaction) that has been pre-configured with a known seed phrase, or a tampered firmware update prompt that asks for the existing seed phrase to "migrate" funds. Anyone who moves funds onto a device whose seed phrase was ever shown to someone else, even briefly, has handed over control regardless of how official the device looks.
Across all five categories, three red flags recur: urgency ("act now or lose access"), a request for your seed phrase or private key, and a return that sounds too good to be true. Any one of these should trigger scrutiny; two or more together is close to a guarantee you're looking at a scam. A useful habit that catches most of them before any damage is done: never click a link in an unsolicited message to reach a wallet or exchange — type the known address directly into the browser every time.
Worked Example
Dissecting a realistic phishing message step by step:
"URGENT: Unusual login detected on your account. Your account will be suspended in 24 hours unless you verify your identity. Click here: coinbase-secure-verify.com and enter your recovery phrase to confirm ownership."
Three red flags appear together: (1) urgent language designed to short-circuit careful thinking — "24 hours or suspension" pressures a fast, unverified click; (2) a lookalike domain, coinbase-secure-verify.com, which is not coinbase.com and exists only to look plausible at a glance; (3) a direct request for the recovery phrase (seed phrase), framed as routine "verification" — but no legitimate exchange or wallet ever asks for your seed phrase, because they never need it to verify your identity on their own platform; the seed phrase only unlocks a self-custody wallet, which the exchange doesn't control at all. Any one of these three would warrant suspicion; all three appearing together is a textbook scam signature.
A second, shorter example shows the giveaway pattern in miniature: a verified-looking social media account impersonating a well-known entrepreneur posts "Send 0.1 BTC to this address, receive 0.5 BTC back — limited time, first 500 participants only." The too-good-to-be-true return (5x in minutes) is sufficient on its own to identify this as a scam; the account being "verified" or having a recognizable name attached proves nothing, since impersonation of real public figures is the entire mechanism these scams rely on.
Exercise
Three message excerpts. For each, decide if it's a scam, and if so, name the specific red flag (urgency, seed-phrase request, or too-good-to-be-true return):
- "Congratulations! Send 0.01 BTC to this address and receive 0.02 BTC back within 10 minutes, guaranteed!"
- "Hi, this is Kraken support following up on your ticket #44218. We do not need your password or seed phrase to assist you — please reply with the last 4 characters of your account email so we can confirm it's you."
- "Your wallet will be permanently locked in 1 hour. Enter your 12-word recovery phrase at wallet-restore-now.net to prevent loss."
Answer key for self-check: (1) Scam — too-good-to-be-true return; no legitimate mechanism doubles Bitcoin for simply sending it to an address. (2) Not a scam signature as written — it explicitly does not ask for a password or seed phrase and asks only for a low-sensitivity confirmation detail, consistent with real support practice. (3) Scam — both urgency ("1 hour" deadline) and a direct seed-phrase request on a clearly unofficial domain (wallet-restore-now.net), a double red flag.
Recap
- The single rule that stops nearly all scams in this lesson: no legitimate service will ever ask for your seed phrase, under any circumstance, whether by message, phone, or a device sent in the mail.
- Combine that rule with skepticism of urgency and guaranteed returns, and typing known URLs manually instead of clicking links, to cover the large majority of real-world Bitcoin losses.
- Scams exploit people, not Bitcoin's cryptography — the next lesson shifts to a different kind of real-world consequence: how Bitcoin transactions are taxed.