How to Keep Your Bitcoin Safe

Keeping bitcoin safe comes down to two habits. Keep your seed phrase offline and private, and never send coins to anyone who promises to send more back. Most losses I hear about trace back to breaking one of those two rules.

The rest is about slowing down. Check where you're sending money, be suspicious of anyone who contacts you first, and assume that a deal which sounds generous is bait. The sections below go through the common traps and what to do about each one.

Why "send 1, get 2 back" is always a scam

On July 15, 2020, the Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Apple and many others posted the same kind of message. Send bitcoin to this address and you'll get double back, for the next 30 minutes only. The address was the one in this site's name. People sent money, and none of it came back. You can read the full story of the 2020 Twitter hack if you want the details.

The pitch still runs every day on fake livestreams and lookalike profiles. It borrows someone's trust and adds a deadline so you don't stop to think. If anyone really wanted to hand out bitcoin, they wouldn't need you to send yours first.

What makes this kind of scam so painful is how bitcoin works. A transaction can't be canceled or charged back once it's confirmed. There's no bank to call and no dispute button. The network has no central operator, so nobody has the power to reverse a payment, even when everyone agrees it was fraud.

Your seed phrase is the whole wallet

When you set up a wallet, it gives you a list of words, usually 12 or 24. That list is your seed phrase (some wallets call it a recovery phrase). Anyone who has those words can rebuild your wallet on their own device and move every coin in it. They don't need your password or your phone.

A few rules I don't bend on:

• Never type your seed phrase into a website, a browser extension, or a form. A legitimate wallet only asks for it when you're restoring the wallet on your own device.
• Never share it with anyone, including people who say they work for a wallet company or an exchange. Real support staff will never ask.
• Write it on paper or stamp it into metal, and keep it somewhere safe from fire and water.
• Don't take a photo or screenshot of it, and don't save it in cloud storage, email, notes apps, or a password manager that syncs online. Those places get breached, and phones back up photos automatically.
• Consider keeping a second copy in a separate location, so one house fire or flood doesn't wipe you out.

If you ever suspect someone has seen your seed phrase, treat the wallet as compromised. Create a new wallet with a fresh phrase and move your coins there right away.

Hardware wallets, software wallets, and exchanges

There are three common ways to hold bitcoin, and each one trades convenience for control in a different way.

Leaving coins on an exchange is easy, and for small amounts that's a reasonable choice. The catch is that you don't really control them. If the exchange fails or locks your account, you wait like every other customer. People often sum it up as "not your keys, not your coins."

Self-custody means you hold the keys yourself, either in a software wallet or a hardware wallet. A hardware wallet keeps the private keys on a small device that never exposes them to your computer, so malware on your laptop can't simply copy them. The tradeoff is responsibility. If you lose the device and your seed phrase backup, there's no help desk that can get your coins back.

Plenty of people use a mix: a little on an exchange or phone wallet for spending, savings on a hardware wallet. Buy hardware wallets new, directly from the manufacturer or an authorized seller. A secondhand device or one that arrives with a seed phrase already printed in the box should be treated as a trap.

Check the address before you hit send

Bitcoin addresses are long strings of letters and numbers, and almost nobody reads them in full. Scammers know this.

One trick is clipboard-hijacking malware. You copy an address, and the malware quietly swaps it for one the attacker controls when you paste. The new address often starts and ends with similar characters, so a quick glance won't catch it.

Here's how I check before sending anything meaningful:

1. Paste the address, then compare it against the source character by character in chunks, not just the first and last few.
2. If your wallet or the recipient can show a QR code, scan it instead of copying text.
3. For a large amount, send a small test transaction first and confirm the other side received it.
4. On a hardware wallet, check the address on the device's own screen, since that screen can't be altered by malware on your computer.

Keep your computer and phone updated, and don't install pirated software or random browser extensions. Those are the usual ways this kind of malware gets in.

Phishing sites, fake apps, and fake support

A lot of theft happens on pages that look exactly like a real wallet or exchange. You might arrive there from a search ad, an email saying your account is locked, or a link in a direct message. The page asks you to log in or "verify your wallet" by entering your seed phrase.

Fake apps work the same way. They copy the name and logo of a known wallet and show up in app stores or on download sites. Before installing a wallet, check the developer name and get the link from the company's own site, which you typed in yourself.

Then there's fake support. You post a question in a public forum or on social media, and within minutes someone replies or sends a direct message offering help. They'll ask you to connect your wallet to a site, share your screen, or read out your recovery words. Real support doesn't reach out first in your DMs, and it never asks for your seed phrase.

Remember: Nobody legitimate will ever ask for your seed phrase, and that includes anyone who says they work for your wallet or exchange.

Fake celebrities, fake companies, and deepfakes

The 2020 hack used real accounts, which is rare. Most impersonation today uses fake ones. A profile copies a famous person's photo, name, and bio, then replies under that person's real posts with a giveaway link. Paid verification badges have made this easier, since a checkmark no longer tells you much about who is behind an account.

Video has caught up too. Scammers now run livestreams with deepfake footage of well-known tech founders or executives "announcing" a crypto giveaway, often with a QR code on screen. The voice and face can look convincing, especially on a small phone screen.

Would this person really need you to send them money first? They wouldn't, so close the stream.

Companies get impersonated as well, through fake promotion pages, fake airdrops, and fake "migration" notices telling you to move funds to a new wallet. When in doubt, go to the company's official site yourself and look for the announcement there.

What to do if you sent coins to a scammer

First, don't blame yourself into silence. These scams are built by people who do this full time. Acting quickly gives you the best chance of limiting the damage.

1. Stop sending anything more. Scammers often come back with a story about a "fee" needed to release your doubled payout.
2. Write down what you have: the transaction ID, the address you sent to, dates, amounts, and screenshots of the messages or posts.
3. If you sent from an exchange, contact its support through the official app or website. They can't reverse the transaction, but they may flag the receiving address, and that can help if the scammer tries to cash out through a regulated service.
4. Report it to your local police and to your country's national fraud reporting agency. Even if the money isn't recovered, reports help investigators link cases together.
5. Report the account or post that scammed you to the platform where you saw it.

Then watch for the second wave. People who post about losing money get flooded with messages from "recovery experts," "blockchain investigators," and fake lawyers who promise to trace and return the coins for a fee. Some even claim to work with law enforcement. They are almost always the same kind of criminals, sometimes the same ones. Legitimate agencies won't charge you an upfront fee to get stolen money back.

If your bitcoin is safe, the next thing to lock down is the social account scammers would love to borrow. I wrote up the steps in how to secure your X account.

Questions