Blockchain/Level IV · Protocol depth/4.3 Custody and privacy/Lesson 5
Operational security and common scams
The cryptography holds; the human doesn’t
MaterialsA hardware wallet with an independent display screenA separate air-gapped device for long-term storageThe US FBI Internet Crime Complaint Center (IC3) annual report on cryptocurrency fraud
Wonder
- Why can a hardware wallet still lose funds to a phishing site?
- How can a transaction signed by a legitimate key be sent to an attacker’s address without the user noticing?
- Why do most losses come from deception rather than broken cryptography?
Explore
- Bitcoin’s protocol security rests on secp256k1 elliptic curve cryptography; no known method breaks it. Yet most significant losses stem from social engineering rather than mathematical failure. The ledger is immutable, meaning a confirmed transaction cannot be reversed by any authority. This finality protects the network but leaves individual holders exposed to irreversible errors and deception.
- Phishing is one of the most common routes to theft. Attackers deploy lookalike domains or counterfeit wallet applications that mimic legitimate interfaces. Victims enter seed phrases or private keys into these fake environments, granting attackers full control. The US FBI’s Internet Crime Complaint Center reports consistently high volumes of cryptocurrency fraud annually, with investment scams the largest category by losses.
- Clipboard malware operates silently in the background, replacing copied addresses with attacker-controlled ones. Users copy a legitimate address from their wallet or contacts, paste it into a transaction builder, and unknowingly send funds to a different destination. Address poisoning compounds this risk: attackers send small amounts of dust from an address visually similar to one in the user’s own history, hoping the victim copies the lookalike entry from their transaction log.
- Social engineering extends to impersonation and long-con schemes. Fake support staff contact users claiming account issues or offering recovery services for stolen funds; no legitimate entity requests seed phrases. ‘Pig butchering’ scams involve months of relationship-building before directing victims to fraudulent investment platforms. In July 2020, hackers compromised prominent Twitter accounts, including those of major tech executives, to promote a giveaway scam that promised doubled bitcoin deposits.
- SIM swapping targets exchange accounts by convincing telecom providers to transfer a victim’s phone number to an attacker-controlled device. Once in control of the number, attackers receive SMS-based login codes and gain access to exchange wallets. Physical coercion, known as a ‘wrench attack,’ involves seizing hardware devices or forcing seed phrase disclosure through threat or violence, bypassing all digital security controls entirely.
- Operational practices mitigate these risks without eliminating them. Users verify recipient addresses on the independent screen of a hardware wallet before signing, ensuring the destination matches their intent. Many maintain separate devices for daily transactions and long-term storage, reducing exposure to malware. Staying quiet about holdings limits targeting; public declarations of wealth attract attention from both scammers and physical threats.
Key facts
- Bitcoin losses come from deception, user error and failures of services, not from broken cryptography.
- Clipboard malware replaces copied addresses in the system buffer, redirecting transactions to attacker-controlled accounts.
- Address poisoning involves sending dust from a lookalike address so victims copy it from their transaction history.
- The July 2020 Twitter account hijacking used hijacked high-profile accounts to push a fake bitcoin giveaway to their followers.
- SIM swapping lets attackers receive SMS-based login codes by moving a victim’s phone number to their own device.
- Hardware wallets display destination addresses on their physical screens, enabling verification independent of the host computer.
Exercise nine, six, three, one
9CollectList 9 distinct types of cryptocurrency scams or social engineering attacks described in recent law enforcement reports or security advisories. For each, note the primary mechanism of deception and whether it targets self-custody wallets, exchange accounts, or both.
6ClusterGroup the 9 scam types into 6 categories based on their operational vector: direct key extraction, transaction redirection, account takeover via secondary factors, long-term relationship manipulation, physical coercion, or protocol-level exploitation. Justify each grouping by the specific technical step where deception occurs.
3DistillReduce the 6 clusters to 3 fundamental human vulnerabilities that scammers exploit regardless of the specific scam type used.
1CrystallizeWrite one sentence explaining why finality, a core feature of blockchain security, simultaneously protects the protocol and maximizes individual vulnerability to fraud.
Fact check
Dates, figures and claims checked against the published sources listed below.