Social Engineering: The Biggest Threat to Holders

The biggest threat to your bitcoin is not a hacker who breaks your encryption but someone who talks you into something. Social engineering means an attacker gets you to reveal your seed phrase, install an app or send bitcoin yourself. No hardware wallet stops a payment you confirm yourself. Three rules help: nobody ever needs your seed phrase, you only call back on a number you looked up yourself, and you take your time.

Why people are easier to crack than bitcoin

Finding a private key by trial and error is hopeless with today's technology. A conversation, on the other hand, takes ten minutes. That is why attackers almost never go after the cryptography, but after the person who holds the key.

Bitcoin makes this especially rewarding for them. Once confirmed, a payment is final. There is no bank to recall a transfer and no hotline to freeze an account. What you send yourself is gone. This finality is one of Bitcoin's strengths, but it applies to mistakes too.

On top of that, if you hold your own bitcoin, you are your own bank. There is no clerk who becomes suspicious when a 70-year-old suddenly sends everything to an unknown address. The protection that a second person provides at a bank has to come from a habit in your case.

The levers attackers pull

Social engineering works because it exploits normal human reactions. Psychology has known them for decades. Almost every scam uses two or three of them at once:

• Authority: someone poses as support, a bank, the police, a prosecutor or the manufacturer. We follow instructions from bodies we trust.
• Urgency: "Your account will be locked in 30 minutes." Under time pressure we check less.
• Fear: "Bitcoin is leaving your account right now." Frightened people want to act, not think.
• Trust and affection: an acquaintance who has been writing kindly for weeks eventually asks for a favour.
• Greed and hope: a profit that sounds too good, or the prospect of getting lost money back.
• Helpfulness: a "colleague" or "family member" is in trouble.

How these thinking errors also distort your buying and selling decisions is explained in the article Cognitive biases in Bitcoin investing.

How attackers know so much about you

A convincing call starts with knowledge. The caller gives your name, your exchange, perhaps the last digits of your phone number or your postal address. It sounds genuine because it is correct.

The sources are usually mundane: data leaks at providers, public posts on social media, photos with a recognisable hardware wallet, forum discussions under your real name. Two documented cases show the pattern:

• Ledger, 2020: after a leak from its customer and marketing database, buyers of the hardware wallet received fake emails, letters, replacement devices and threats for years.
• Coinbase, 2025: bribed staff at a support contractor passed on customer data. Attackers used it to call customers, pose as Coinbase and persuade them to send their bitcoin to a supposedly safe account. Coinbase announced it would reimburse affected customers.

What you can do so that less is known about you, and how to protect yourself against threats and violence after a leak, is covered in the article Discretion and physical security. This article is about the conversation itself.

Typical attacks on Bitcoin holders

You will find a full catalogue of scams with their warning signs in the article How to spot Bitcoin scams. The overview here only shows which lever each attack pulls and what the right answer is.

The last case isn't aimed at you but at the employee in the phone shop or at the hotline. How it works and how to secure your number is explained in the article SIM swapping and how to protect yourself.

The "your account is compromised" call

This attack deserves a closer look because it works particularly well. It reverses the roles: the attacker warns you about fraud while committing it.

Real exchanges don't call in such cases to have you move coins. If an account really is at risk, the provider locks it itself. It needs neither your codes nor your bitcoin to do so.

Why technology can't fix this

There are tools against hackers: hardware wallets, PINs, passphrases, multisig. Against persuasion they help only so much. The reason is simple: they protect against someone acting without your consent. Social engineering obtains your consent.

• The hardware wallet correctly shows you the address you are sending to. If the attacker has convinced you that it is the right address, you confirm it.
• The seed phrase bypasses every device. If you type it into a website, the attacker no longer needs your device at all.
• Two-factor codes only protect you as long as you don't read them out.
• Providers' data protection can fail, as the leaks show. You have no influence over it.
• Real-looking voices and videos can now be faked with little effort. In 2024, an employee of the engineering firm Arup in Hong Kong transferred around 25 million US dollars after sitting in a video conference with faked colleagues and a faked chief financial officer.

Even professionals fall for it. In July 2020, attackers phoned Twitter employees, posed as internal IT and gained access to internal tools that way. They then posted a supposed bitcoin-doubling offer from accounts such as those of Barack Obama, Elon Musk and Apple. Within a few hours, more than 100’000 US dollars in bitcoin came in.

What technology can do, however, is slow you down. The more time and steps a large payment requires, the more likely you are to notice the fraud. If your main holdings sit in a multisig wallet whose keys are kept in two different places, you can't send everything within ten minutes on the phone. This friction is a protection, not a flaw.

The three rules that stop almost everything

You don't need to know every scam. Three rules cover almost every case, because they don't depend on the content of the story but on how it unfolds.

1. Nobody ever needs your seed phrase

No manufacturer, no exchange, no support desk, no authority and no lawyer. There is no legitimate reason to enter your words anywhere other than your own device when you are recovering a wallet yourself. Anyone who asks for them is an attacker. Without exception.

The same goes for the "safe account": nobody who wants to protect you asks you to send your bitcoin to an address he gives you.

2. You call them, not the other way round

The number your phone shows can be faked, and so can the sender of an email or text message. Hang up and contact the organisation through a channel you found yourself: the official app, the website you type in yourself, the number on your bank card. Not via the link or number in the message.

The same applies to family and friends. If "your daughter" asks for money in a voice message, call her on the number you have saved. An agreed family code word that isn't written down anywhere helps against faked voices.

3. Slow down

Pressure is the surest warning sign. Real problems can wait an hour. Make yourself a firm rule: no payment and no entry you didn't plan yourself on the same day. Talk to someone you trust first.

More habits that protect you

Besides the three rules, a few simple habits help:

• No remote access on request. Programs such as AnyDesk or TeamViewer give a stranger control over your computer. Never install them because a caller asks you to.
• Don't read out codes. A confirmation code is for you alone. Whoever wants to hear it wants to log in as you.
• Never look for help in comments. Anyone who asks for help publicly on X, Reddit or Telegram receives messages from "support staff" minutes later. Real support doesn't message you privately out of the blue.
• Software only from the manufacturer's site. Download wallet apps from the address you type in yourself, not via search engine ads.
• Don't show your holdings. The fewer strangers know that you own bitcoin, the less often you become a target.
• Let your family in on it. Older relatives are frequent targets. Explain the three rules to them, even if they don't own bitcoin themselves. They might get the call that concerns you.

If it has already happened

If you have revealed a seed phrase, every minute counts. Immediately set up a new wallet with a new seed phrase on a trustworthy device and send everything that is still there to it. The old seed phrase is burnt for good.

If you gave an attacker access to your exchange account, change the password and second factor, report the incident to the provider via the app and get confirmation that withdrawals are blocked. Then file a report with the police; in Switzerland you can also report the case to the Federal Office for Cybersecurity.

Don't be ashamed. Social engineering catches engineers, IT people and experienced investors, because it doesn't attack knowledge but human reactions. Talking about it openly warns others. What else you can do after a scam is also covered in the article How to spot Bitcoin scams.