Learn › Chapter 5 of 11

Chapter 5 · Where the real danger is

How Bitcoin Actually Gets Stolen (They Just Ask)

Prefer to watch? This chapter is also a short video (about 4½ minutes). The full text is below.

In one minute: Thieves almost never break bitcoin. They ask for it. They pose as support, send official-looking emails, publish fake apps, sell tampered devices, and look for people who talk about what they own. Every one of these tricks ends the same way: you type your recovery words somewhere, or you send bitcoin yourself. So one rule stops nearly all of them: nobody real will ever ask for your recovery words. Add two habits, slow down when it feels urgent and go to the source yourself, and you've closed the doors most families leave open.

People picture bitcoin theft as a hacker in a hoodie breaking into the network. That almost never happens.

What happens instead is quieter. Someone friendly offers to help. An email looks exactly like the real company. An app looks exactly like the real app. The thief doesn't break anything. They get you to open the door.

The U.S. Federal Trade Commission counted more than 46,000 people who reported losing over $1 billion in crypto to scams in a little over a year, starting in 2021. Nearly half said it started with an ad, post, or message on social media. ¹

Here are the five shapes it usually takes.

1. The helpful stranger

You post a question online: "My wallet isn't showing my balance, any ideas?" Within minutes, someone messages you. They're from "support." They're kind, patient, and they can fix it. They just need you to "verify" your wallet.

People pretending to be companies or government agencies took $133 million in crypto in the same FTC count. ¹

Real support never messages you first, and never asks for your words.

2. The message that really looks real

Some fakes are sloppy. Some are perfect.

In June 2025, thieves found a way to make a hardware wallet company's own support system send their message. Customers got an email from the company's real address, with an urgent subject line pointing to a website. The website asked for their recovery words. ²

The sender was real. The message wasn't. That's why the address an email comes from isn't enough to trust it.

Never follow a link in a message about your bitcoin. If you're worried, go to the company's website yourself by typing it in.

3. The fake app

Your hardware wallet comes with a companion app for your computer or phone. Thieves make copies.

In late 2023, a fake version of a well-known wallet app sat in Microsoft's official app store for about two and a half weeks. People who installed it and typed in their recovery words lost about $768,000 in total. One person said they lost everything within minutes. ³

An official store isn't proof. Download wallet apps only from the link on the maker's own website, typed in yourself. And remember Chapter 3: the real app never needs your recovery words. Only the device does.

4. The tampered device

You've already met these: the "replacement" device that arrived in the mail (Chapter 3), and the second-hand one that came with its words already filled in (Chapter 4). Buy new, direct from the maker, and never use a device that comes with words or comes already set up.

5. Telling people

The last danger isn't online. It's what other people know.

Most families will never face this. But crimes against people known to own crypto do happen. In January 2025, a co-founder of a hardware wallet company and his partner were kidnapped from their home in France for a crypto ransom. Police freed them within about a day and arrested ten people. ⁴

The fix costs nothing: don't talk about how much bitcoin you have. Not at parties, not online, not in a family group chat. The people who need to know are in your plan, and that's it.

The pattern, and the rules that stop it

Look back at all five. Each one ends with you doing one of two things: typing your recovery words somewhere, or sending bitcoin yourself.

So these rules close almost every door:

1. Nobody real will ever ask for your recovery words. Not support, not your exchange, not the maker of your device, not the government, not us. Anyone who asks is a thief, every time.
2. Urgency is the warning sign. "Act now," "your wallet will be locked," "verify within 24 hours": real companies don't rush you. Slow down.
3. Go to the source yourself. Don't click links or call numbers you were sent. Type the website in yourself, or use the contact details from the box your device came in.

And one agreement for the two of you: if anyone ever contacts either of us about our bitcoin, we stop and talk to each other first. That matters most for the partner who doesn't usually handle it, because thieves often go after whoever knows the least.

Talk about it

1. If "support" messaged one of us tomorrow, what would we do?
2. Where did we download our wallet app? Do we know it's the real one?
3. Who knows we own bitcoin? Is that more people than it needs to be?

Agree on the "we talk to each other first" rule out loud, tonight.

Sources