Bitcoin scams to know in 2026 (and how to avoid them)

Short answer: almost every bitcoin scam ends one of two ways. Either you send bitcoin to the scammer, or you give away your seed phrase (the 12, 20 or 24 backup words that control your wallet). Bitcoin payments typically can’t be reversed (FTC), so prevention is everything. Two rules stop most of them: never send bitcoin because someone who contacted you told you to, and never type or share your seed phrase anywhere. No real company, government agency or “recovery expert” will ever need either.

Below: how big the problem is, the scams costing people the most right now (including two real cases from October 2026), the red flags, simple habits that protect you, and exactly what to do if it already happened.

How common are bitcoin and crypto scams?

Very. In its 2025 report, the FBI’s Internet Crime Complaint Center (IC3) counted 181,565 complaints involving cryptocurrency with $11.366 billion in reported losses, up 22% from 2024. Crypto investment fraud (fake trading platforms and apps) was the biggest category at $7.228 billion, and people 60 and over reported the most losses of any age group, about $4.4 billion (FBI IC3 2025 report). Those are only the cases people reported.

On October 19, 2026, California’s Attorney General put out a crypto scam warning citing the same national numbers and pointing to a sharp rise in reports of Gen Z being targeted on platforms like Twitch, TikTok and Instagram (California DOJ). So this isn’t only an “older people” problem.

Every scam is after one of two things

The story changes (a romance, a police officer, a security alert, a giveaway), but the ending doesn’t. Trezor puts the seed side bluntly: any request for your wallet backup, PIN, passwords or codes is always a scam (Trezor). The FTC puts the payment side just as bluntly: only scammers demand payment in cryptocurrency, and only scammers guarantee profits (FTC).

The bitcoin scams to know in 2026

1. Fake investment platforms (“pig butchering”)

How it works: someone reaches out by text, social media, an ad or a dating app, then quickly moves you to a messaging app. You’re shown a professional-looking trading platform with big “profits.” When you try to withdraw, suddenly there are taxes and fees to pay, and then they disappear with everything. The FBI says these operations are largely run by organized criminal groups in Southeast Asia (FBI IC3).

Red flag: anyone you met online offering to teach you to trade. The FTC’s rule: never mix online dating and investment advice (FTC). And a withdrawal that needs a “fee” first is the scam announcing itself.

2. “Pay at a Bitcoin ATM” (government, bank and tech-support impersonation)

How it works: a call, text or computer pop-up says there’s fraud on your account, your information is linked to a crime, or your money is at risk. A “government agent” may join the call. You’re told to withdraw cash, go to a specific Bitcoin ATM, and scan a QR code they send, which pays straight into the scammer’s wallet (FTC). In 2025 the FBI received over 13,400 complaints involving crypto kiosks, with losses over $388 million, a 58% jump in losses from 2024 (FBI IC3).

Red flag: the FBI says no legitimate law enforcement or government official will call to demand payment through a crypto kiosk (FBI IC3). The FTC adds: never withdraw cash because of an unexpected call or message, and talk to someone you trust first (FTC). If the kiosk operator calls to warn you, stop the transaction (FBI IC3).

3. Fake support calls and fake security alerts

How it works: a message “from your wallet company” says your device will be disabled, your account was accessed, or you need to “verify your backup.” Trezor says it cannot deactivate your device, will never contact you about your wallet backup, and that a phone caller claiming to be Trezor or another wallet company should be hung up on immediately. It also warns that scammers now use AI to fake support in text, voice and video (Trezor).

Real example, October 17, 2026: attackers hijacked the third-party service that sends push notifications for NGRAVE’s LIQUID app, so users got a fake “your portfolio was synced on a new device” alert through the real app. It led to a copy of NGRAVE’s website with a countdown, and the “Deny” button led to a page asking for the recovery phrase. Wallets whose phrases were entered were emptied within minutes; NGRAVE traced about $2.56 million taken from about 70 addresses. NGRAVE says its devices and private keys were not breached; people who only tapped the link without typing their words kept their funds (NGRAVE).

The lesson: even an alert that arrives inside the real app can be fake. The one thing that would have saved everyone: no real alert ever needs your recovery phrase.

4. Fake websites, ads and wallet apps

How it works: scammers buy search ads that look like a real wallet or exchange. The FBI says these ads sit at the top of results, link to a copy of the real site, and have been used to impersonate crypto exchanges to steal logins and funds, or to serve malware disguised as the real download (FBI IC3).

How to avoid it: type the address yourself or use a bookmark instead of clicking ads (FBI IC3). Download wallet software only from the maker’s own site; Trezor, for example, says to get Trezor Suite only from trezor.io (Trezor).

5. Swapped addresses: clipboard malware and address poisoning

How it works: malware on your computer or phone can change the address after you paste it, so you approve a payment to the attacker. A related trick, address poisoning, plants a lookalike address in your transaction history hoping you’ll copy it next time (Trezor). Trezor says poisoning mostly targets Ethereum-style networks, but address spoofing can happen on any blockchain (Trezor).

How to avoid it: take the address from the original source (the exchange’s deposit screen or the person you’re paying), never from your history. If you use a hardware wallet, check the address on the device’s own screen before you sign; that’s the address the transaction will actually pay (Trezor). For bigger amounts, send a small test first.

6. Giveaways, “doubling” and deepfakes

How it works: a “celebrity” promises to send back double whatever you send, or a video of a famous person pitches a platform. The FTC says celebrities aren’t contacting you through social media, and free-money promises are always fake (FTC). California’s AG warns that scammers now use AI voice clones and deepfake videos of loved ones and public figures (California DOJ).

7. Tampered or pre-set-up hardware wallets

How it works: in October 2026 Ledger said a criminal group bought genuine devices, fitted hidden parts designed to capture the recovery phrase during setup, and put them back into distribution through resellers in Southeast Asia. Ledger said its own chip, operating system and servers weren’t compromised; the attack was on the distribution channel (Ledger).

How to avoid it: buy from the maker or a reseller the maker lists. Trezor says its official store is the best place to buy, and devices from its shop, its Amazon storefront or an authorized reseller are generally considered safe (Trezor). If you’re buying one, here’s Trezor’s official store (affiliate link; I may earn a commission at no extra cost to you). Never use a device that arrives already set up or with words already filled in, and always create a new seed yourself. More in hardware wallets explained.

8. Fake “recovery” services (the second scam)

How it works: after someone loses money, “recovery experts,” fake law firms or fake government officials contact them promising to get it back, for an upfront fee. The CFTC calls this advance-fee fraud aimed at people who were already scammed (CFTC). The FBI received 10,516 recovery-scam complaints in 2025 with $1.4 billion in reported losses (which can include the earlier scam) (FBI IC3).

Red flags from the FBI and CFTC: they contact you first, already know details of what you lost, claim to be “official partners” of a government agency (the FBI says no law firm is), use Gmail or WhatsApp, or ask for fees, “taxes” or crypto before you get anything (FBI IC3, CFTC).

Also watch for: “jobs” that make you pay a fee in crypto, which the FTC says is always a scam, and emails threatening to leak embarrassing material unless you pay in crypto, which the FTC calls criminal extortion to report to the FBI (FTC).

Red flags: the 5-question stop check

If you’re unsure, end the contact and reach the company or agency yourself using the phone number or website you look up, not the one in the message (FTC, CFTC).

How to protect yourself: 7 habits

1. Your seed phrase stays offline and private. Never type it into a website, a form or a chat, and never read it to anyone. Trezor says never share it or make a digital copy (Trezor). How to store it safely is in how to back up your seed phrase.
2. You decide when to buy or send, never a stranger. If you want bitcoin, buy it yourself in an app you chose and downloaded from the official app store. I buy mine on Strike, and I also have a River account: Strike This is my referral link. If you sign up, I may earn a reward at no cost to you. · River This is my referral link. If you sign up, I may earn a reward at no cost to you.
3. Ignore anyone who contacts you first about your wallet, an investment or a “problem.” Go to the official site yourself (FTC).
4. Bookmark the real sites for your exchange and wallet software, and don’t click search ads for them (FBI IC3).
5. Check every address on the original source and on your device, and send a small test first for larger amounts (Trezor). Step by step in how to safely move your bitcoin to a new hardware wallet.
6. Buy hardware wallets from the maker and set them up fresh yourself (Trezor).
7. Slow down and tell someone. Scammers want you rushed and alone; the FTC says to stop and talk with someone you trust before doing anything (FTC). Not sure your setup is solid? The Is My Wallet Safe? checker asks four questions and runs in your browser.

Already scammed? What to do right now

1. Stop sending. Don’t pay any “fee” to unlock a withdrawal or recover funds. That’s the next stage of the same scam (FBI IC3).
2. If you typed or shared your seed phrase, treat that wallet as unsafe even if it still looks untouched. Move what’s left to a new wallet with a new recovery phrase, and don’t send anything to the old addresses again (NGRAVE). If malware swapped an address, don’t use that computer or phone with a wallet again until it’s been cleaned or reset.
3. Write down the details: the addresses you sent to, the amount, the date and time, and the transaction ID, plus how the scammer contacted you, their names, numbers, emails and websites, and which exchange or ATM you used (FBI IC3, FBI IC3). Keep receipts.
4. Report it to the FBI at ic3.gov, to the FTC at ReportFraud.ftc.gov, and to the exchange you used to send the money (FTC, FBI IC3). File a local police report too: NGRAVE notes exchanges usually act on freezing funds only with one (NGRAVE).
5. Expect recovery scammers. Anyone who contacts you offering to get it back for a fee is the second scam (CFTC).

Be honest with yourself about the odds: the FTC says you can usually only get crypto back if the person you paid sends it back (FTC). Reporting still matters: it helps agencies track frauds, pursue the fraudsters and warn others (CFTC).

If you’ve written inheritance instructions for your family, put “nobody legit will ever ask for these words” at the top. Recovery scammers target grieving families too. More in the bitcoin inheritance plan guide and the free Bitcoin Inheritance Kit.

What this guide can’t tell you

New scams appear all the time, and the numbers above are reported complaints only. This guide can’t judge a specific message or website for you; when in doubt, contact the company or agency through its official site. If you’ve lost money, the FBI’s IC3 and your local police are the right places to report it. Nobody from An Honest Node will ever DM you, offer to recover funds, or ask for your seed phrase. Educational only, not financial advice.