Common Bitcoin Wallet Scams
Self-custody is powerful — but it also makes you the primary target. These are the scams that drain wallets every week, and exactly what to watch for.
Ashir Khan writes about cryptocurrency security, self-custody, macro market analysis, and regulatory policy at CryptoBeacon.
The golden rule: Your seed phrase and private keys are never needed by any legitimate service, website, or support agent. If anything ever asks for them, it is a scam.
The five most common wallet scams
Fake wallet apps
Attackers upload near-perfect clones of popular wallets (MetaMask, Trust Wallet, Exodus) to app stores. The apps look identical but silently transmit your seed phrase or private keys to the attacker's servers the moment you enter them.
Download only from the official wallet website. Search the developer's site for the official app store link rather than searching within the app store directly.
Seed phrase phishing sites
Fake wallet websites — often ranking in paid search results — claim you need to 'restore' or 'verify' your wallet. They prompt you to enter your seed phrase, which goes directly to the attacker.
Your seed phrase never needs to be entered online. No legitimate service will ever ask for it. If a site does, close it immediately.
Clipboard hijacking malware
Malicious software monitors your clipboard. When you copy a crypto address, it silently replaces it with the attacker's address. If you paste without verifying, you send funds to the wrong place.
Always check the last 6–8 characters of a pasted address against the original. Some hardware wallets display the address on their screen for you to verify before signing.
Pre-seeded hardware wallets
Compromised hardware wallets bought from third-party sellers arrive with a seed phrase already written on an included card, or on a slip inside the packaging. The attacker retains a copy of that phrase and waits for funds to arrive.
Buy hardware wallets only from the manufacturer directly. If a seed phrase comes pre-written on any included material, discard the device — generate your own fresh seed during setup.
Support impersonation scams
"Crypto support agents" contact users on Twitter, Reddit, Telegram, or Discord claiming to help with wallet issues. They escalate to asking for seed phrases under the guise of troubleshooting.
No legitimate wallet company has unsolicited support agents in social media DMs. Never share your seed phrase with anyone in any channel.
General rules for wallet safety
- Generate your seed phrase on a device that has never been connected to the internet (hardware wallet or air-gapped computer)
- Write the seed phrase on paper or metal immediately — never type it or photograph it
- Store backups in physically separate, secure locations
- Verify every address character-by-character before signing a transaction
- Keep your wallet software and firmware updated
- Use a hardware wallet for any amount you would not want to lose