Protecting yourself from a Bitcoin address scam

Key takeaways #

• No one legitimate will ever ask you to send crypto to “receive more back” — giveaway scams are always theft.
• Verify wallet addresses carefully: clipboard malware silently swaps addresses you paste.
• Check reported scam addresses on public abuse databases before sending to any address from a website or message.
• The 2020 Twitter hack, where verified accounts of celebrities solicited bitcoin, remains the textbook example of how convincing these scams look.

If you use social media at all, you’ve probably seen it: a celebrity or public figure’s account promising to double any bitcoin sent to a particular address. In July 2020, attackers hijacked high-profile verified accounts — from politicians to tech billionaires — and posted exactly this con, netting over US$100,000 in a few hours before the accounts were recovered. The mechanics were laughably simple; the borrowed credibility did all the work. These scams haven’t gone away, and as cryptocurrency use grows they only become more common. Here’s how to protect yourself.

How Bitcoin address scams work #

The core of every address scam is convincing you to send crypto to an address the scammer controls, usually with an “incentive” — a supposed 2:1 giveaway match, a fake charity, a prize you need to “unlock” with a small deposit, or a romantic partner you’ve never met who needs help with an “investment platform”. Once the crypto is sent, it’s gone: blockchain transactions are irreversible, and the scammer moves funds through mixing services within minutes.

A quieter variant is clipboard malware. Infect your computer, and whenever you paste a wallet address, the malware silently replaces it with the scammer’s address. At a glance the pasted address looks right — it starts and ends with the same characters — but it isn’t yours. Every crypto user should glance at the first six and last six characters of any address after pasting, or scan a QR code from a device they trust.

Check addresses against abuse databases #

Before sending to any address supplied by a website, message or stranger, check whether it has been reported. Public databases such as Chainabuse (which absorbed the long-running BitcoinAbuse) let you search a Bitcoin address and see reports from other victims — how many times it’s been reported, when, and how much crypto the address has received. During the 2020 Twitter incident, the scam address was reported more than 77 times within hours and shown to have received over 12 BTC. A quick search would have saved every one of those senders.

If you encounter a scam address, report it — these databases only protect people if the community feeds them.

Practical defences #

• Treat every giveaway as a scam by default. Wealthy people and companies do not give away crypto to strangers on social media.
• Verify through independent channels. If an exchange or company really is running a promotion, it will be announced on their own website, not only in a reposted message.
• Check addresses character by character after pasting, especially the first and last segments.
• Beware of urgency. “First 50 senders only” exists to stop you thinking.
• Never share your seed phrase or private keys — no legitimate service, wallet vendor or exchange will ever ask for them.
• Report losses quickly. If you’ve been scammed, report it to Scamwatch and ReportCyber (both run by Australian government agencies). Recovery is unlikely, but reports help disrupt operations and warn others. If the scam ran through an Australian exchange, tell them too.

Cryptocurrency is a secure and convenient way to send and receive money, but like any form of money, a little prudence goes a long way. If a deal sounds too good to be true, on the blockchain as anywhere else, it is.

Frequently asked questions #

Can a Bitcoin transaction be reversed? No. Once confirmed on the blockchain, a transaction is permanent. There’s no bank to call and no chargeback — which is exactly why scammers want payment in crypto.

What if I sent crypto to a scammer? Act fast: contact the exchange you sent from (some can freeze withdrawals before funds are laundered), then report it to Scamwatch and ReportCyber. Recovery is unlikely, but reports help authorities disrupt operations and warn others.

Is it safe to share my Bitcoin address? Yes — a public address alone lets people send you money, not take it. What you must never share is your seed phrase or private key, which controls the funds.

Do address scams only happen on Twitter? No. The same cons appear in Facebook and Instagram ads, WhatsApp messages, dating apps, fake news articles and even SMS. Wherever there’s an audience, borrowed credibility is for sale.