The scams that empty self-custody wallets work on you, not on Bitcoin’s cryptography. Each one is after one of three things: your recovery words (the list of words that backs up your wallet), your approval of a payment to the attacker’s address, or you in person, forced to unlock your wallet. Fake apps, fake support, phishing sites, look-alike addresses, clipboard malware, tampered devices and the “$5 wrench attack” are all versions of those three moves. Once you hold your own keys, nobody can reverse a payment or reset your wallet for you, so your defences are habits you build before anyone tries.
Earlier lessons met these scams one at a time. Here they form one threat model with one rule at its centre, so you can also recognise a scam you have never seen.
One Threat Model: What Attackers Want From You
A threat model is a short list of who might attack you, what they want, how they reach you and what stops them. For self-custody it fits in one table, and each row has its own section below.
| Scam | What it wants | How it reaches you | What stops it |
|---|---|---|---|
| Fake apps and update prompts | Your recovery words | Search ads, copycat download pages, links in emails, “update required” pop-ups | Install from the maker’s site, typed by hand; update only through that app or site |
| Fake support | Your words, or control of your computer | Private messages on Discord and Telegram, emails, letters, phone calls | You start every support contact yourself |
| Seed-entry phishing sites | Your words | Links in emails, messages and search ads; QR codes in printed letters | A request for your words is proof of a scam |
| Address poisoning | A payment to a look-alike address | Tiny deposits that plant the address in your history | A fresh address from the recipient every time, checked in full |
| Clipboard malware | A payment to the attacker’s address | A swapped address when you paste | The address on the hardware wallet’s screen, checked against the recipient’s original |
| Tampered or fake hardware | Your words, before or during setup | Marketplaces, unrequested “replacement” devices, a compromised reseller | A new device from the maker’s own store |
| The $5 wrench attack | You, in person | Anyone who learns that you hold bitcoin | Privacy first; Course 5 covers the rest |
Read down the second column: four scams want your recovery words, two want you to approve a payment, and one wants you. The one rule below stops most of the first group, its twin stops the second, and the rest comes down to where you buy and who knows what you hold.
Flaws in devices and wallet software, such as the 2026 Coldcard bug that made some seeds guessable, are a separate risk; our security advisories page tracks them.
The One Rule
Your recovery words are typed only on the hardware wallet itself, never on a phone, computer or website.
Your recovery words (also called the seed phrase or wallet backup) are a complete copy of your keys. A hardware wallet exists to keep them away from internet-connected devices. Type them into anything else and you have handed out a copy, and the hardware wallet can no longer protect you. You enter them at only three moments: confirming them during setup, running the device’s built-in backup check, and restoring a wallet. All three happen on the device, and you start each one yourself.
The makers say the same. Ledger, which now calls its devices “signers”: “a genuine Ledger signer never asks you to enter your recovery phrase on a computer, phone, app, or website.” Trezor, after phishing emails reached its newsletter subscribers in September 2026: “If you have not entered your wallet backup anywhere other than on your Trezor device during recovery, your assets remain secure.”
The rule means you never have to judge how genuine a message looks:
- Nobody genuine needs your words: no company, support agent, developer or moderator. Trezor: “We will never contact you asking for your wallet backup.”
- No update needs them. A real firmware update (new software for the device itself) comes through the maker’s official app, or its website for devices without one, and you confirm it on the device.
- No website can “check”, “validate” or “sync” them. The free seed safety tools on this site never ask for a single word; a page that does is a scam.
- Your PIN and passphrase (the optional extra word or phrase that opens a separate wallet) get the same treatment: never say, send or type them for anyone who asks.
Two cases look like exceptions. A phone wallet such as Phoenix has its own recovery words for a small spending balance; they go only into a wallet app you installed from its official site or app store, in a restore you started. The Trezor Model One, no longer sold but still supported, can’t take words typed on the device, so its recovery runs through Trezor Suite, and Trezor says to enter them only when “the physical Trezor device instructs you to do so”. Both follow the idea behind the rule: trust your own device, never a message.
The rule has a twin for payments. The hardware wallet’s screen is the one screen malware on your computer can’t change, so the address and amount you approve are the ones you read there (see Hardware Wallets Explained).
Fake Apps and Fake Update Prompts
A companion app is the program on your computer or phone that works with your hardware wallet: Ledger Wallet (formerly Ledger Live), Trezor Suite, the BitBoxApp or Sparrow. A fake one copies the look of the real one, and at some point asks you to “restore”, “migrate” or “verify” your wallet by typing your words.
Fakes arrive through search ads, copycat pages, emails and pop-ups. In September 2026 attackers broke into Brevo, the email service Trezor and BitBox used for their newsletters, and mailed subscribers from the companies’ own newsletter accounts. Trezor’s email was titled “Critical Security Alert: STM32 Entropy Vulnerability” and pushed an app that asked for the wallet backup; Trezor says 347,149 subscriber addresses were exported (our advisory). Fake update messages are older than that: from late 2018, malicious servers showed Electrum users an “update required” message linking to a fake Electrum (the Electrum lesson covers it).
Get the app from the maker: type its web address yourself, bookmark it, and download from there. Updates then come through that app, or, for a device without one such as Coldcard, from the same site. Never install anything from a link in an email, text or private message (Ledger: “we do not send out emails asking you to update device firmware”). You confirm a real update on the device, and it never asks for your words. Trezor asks you to keep your backup within reach in case an update fails and wipes the device; then you restore on the device, as in any recovery. Course 5’s lesson How to Verify Bitcoin Software Before You Install It shows how to confirm that a download is genuine.
Fake Support on Discord, Telegram and Email
You post a question in a wallet’s Discord server or Telegram group, and minutes later a friendly “support agent” writes to you privately, with a link to a “support form” or an offer to take control of your screen. That is fake support: a scammer posing as the company’s help desk.
The makers draw a clear line. Ledger says it “will never send users a direct message on social media” and “will never contact you via text message or phone call”. Trezor says to treat any message claiming to come from it “via text message, WhatsApp, Telegram, phone call, or postal letter” as a phishing attempt.
The lure can even come through an official channel. In May 2025 an attacker took over a moderator’s account on Ledger’s own Discord server and posted a fake warning about a vulnerability, urging users to verify their recovery phrases through a link. The Trezor email above came through Trezor’s real newsletter service. Each time, the request gave it away.
Scammers also work from stolen customer lists: in 2020 the names, postal addresses and phone numbers of about 272,000 customers of Ledger’s online shop were stolen and published. After a loss comes a second wave: “recovery experts” who offer to get your bitcoin back for a fee. The US Federal Trade Commission: “Don’t pay anyone who contacts you, offering to recover money you lost to a scam.”
To get real help, start the contact yourself: type the maker’s web address and use the support form there. Genuine wallet support never needs your words, PIN or passphrase. Treat a request to take control of your computer the same way: the FTC warns that tech-support scammers “ask for remote access to your computer”.
Seed-Entry Phishing Sites
A phishing site is a web page made to look like a real one so that you type a secret into it. For self-custody the secret is your recovery words. These pages ask you to “verify”, “validate”, “sync” or “unlock” your wallet, or to “claim compensation”, and they arrive by email, private message and search ad, even as QR codes in printed letters, which Ledger warns about.
Looks prove nothing, and neither does the sender. BitBox explained that its September 2026 phishing emails could pass the usual email authentication checks because they really were sent through its newsletter provider; the checks showed which service sent them, not that BitBox had approved them. The request for your words is the proof. Close the page, then look up your device on our security advisories page, which opens with the one rule that never changes, and on the maker’s own site, reached by typing the address.
Address Poisoning
In address poisoning, an attacker creates an address that looks like one you have used, with the same first and last characters, and sends you a tiny amount from it. Now the look-alike sits in your transaction history. The next time you copy “the usual address” from your history, you pay the attacker.
It happens on Bitcoin. Jameson Lopp, a Bitcoin security researcher, counted just under 48,000 such payments on the Bitcoin blockchain between July 2023 and January 2025, and found one apparent victim, who sent 0.1 BTC to a look-alike; Your First Withdrawal takes that real pair of addresses apart. A related attack in October 2026 faked the history itself: malicious servers showed Electrum users a fake unconfirmed payment to an address made to end in the same four characters as the real one, and a user who raised its fee paid the attacker (our advisory).
Why the ends are easy to fake, in brief: every Native SegWit address starts with bc1q and every Taproot address with bc1p, so the start tells you almost nothing (more in Bitcoin Address Types and Derivation Paths). After that, these addresses use an alphabet of 32 characters, so each extra character an attacker wants to copy multiplies the work by 32. Copying the last four takes about a million attempts on average (32 × 32 × 32 × 32 = 1,048,576); copying the whole address is out of reach.
What to do:
- Never copy an address from your transaction history. Ask the recipient for a fresh one each time, or use one you saved and labelled when the recipient first gave it to you.
- Compare the whole address, in groups of four characters, on the hardware wallet’s screen, against what the recipient gave you.
- Send a small test amount the first time you pay a new address, as in Your First Withdrawal.
- Leave unexpected tiny deposits alone. Sparrow and Electrum let you freeze them so they’re never spent by accident (see coin control).
Clipboard Malware
Clipboard malware (also called a “clipper”) is a program that watches what you copy. When it sees a bitcoin address, it swaps in the attacker’s address, so what you paste is not what you copied. In March 2023 Kaspersky reported a campaign hidden in fake Tor Browser installers downloaded from unofficial sites: more than 15,000 users in 52 countries, and estimated losses of at least US$400,000. Bitcoin was among the coins it targeted. Downloading only from official sites, as above, closes the door it came through.
Your defence is the hardware wallet’s screen, used the right way. It shows the address you are really paying, so if the swap happened before you pasted, it faithfully shows the attacker’s. Your monitor shows that same pasted address, so checking the device against your monitor proves nothing. Compare it with the original: the recipient’s own screen or invoice, or the address read aloud over a second channel. When you withdraw to your own wallet, compare the withdrawal page with the receive address your hardware wallet shows on its own screen.
Fake and Tampered Hardware
A hardware wallet is only as honest as the path it took to reach you. A seller can set one up in advance and include a card with the recovery words already printed, so the wallet you fund is theirs. Ledger: “A legitimate Ledger device never comes with a recovery phrase or PIN code pre-configured.”
In May 2021 a Ledger customer received an unrequested “replacement” device in convincing packaging, with a letter urging an immediate move. Inside was a soldered flash drive carrying malware. The customer typed their words into the app it offered, and Ledger says about $78,000 was drained within 30 minutes. The rule alone would have saved them.
The CryptoBilis case of October 2026 shows the limit of the rule. CryptoBilis was an official reseller of Ledger and Trezor in Southeast Asia, and Ledger confirmed a hidden implant in a device sold through it. Ledger says attackers bought genuine devices, opened them, fitted “custom-built hidden components designed to capture the recovery phrase during setup” and put them back into distribution through resellers there; its security team found that the implant read the words off the device’s own screen. Trezor has a credible report, not yet confirmed in its lab, of a similar implant in a Trezor Safe 5 (our advisory). Ledger also says its Genuine Check, the app’s test that a device is authentic, “cannot detect unauthorized physical modifications to the hardware” while the original secure chip is in place.
What to do: buy new, from the maker’s own store; refuse any device you didn’t order; and stop if a device arrives with words, a PIN or a wallet already set up. How to Set Up a Hardware Wallet lists the checks for each brand.
The $5 Wrench Attack
The name comes from a 2009 xkcd comic: rather than crack strong encryption, the attackers “hit him with this $5 wrench until he tells us the password”. A wrench attack is any attempt to force you, by threat or violence, to unlock your wallet and send. No rule about typing words helps here, because the attacker makes you do it.
Lopp also keeps a public list of physical attacks on bitcoin and other crypto holders. As of November 2026 it has about 800 entries from 2014 onwards, and 2025 has more than any earlier year. It counts only attacks that were reported.
The first defence is privacy: the fewer people who know you hold bitcoin, the fewer who can target you. That covers what you say, what you post and where your wallet orders are delivered, since shop databases leak. Course 5’s lesson Physical Security, Coercion and Keeping Quiet covers the rest of the defences.
If It Has Already Happened
- You typed your words somewhere other than the device: treat the seed as known to the attacker. Create a new wallet with a brand-new seed on a device you trust, and move everything to it now. Restoring the old words on a new device fixes nothing.
- You paid a look-alike address: if it hasn’t confirmed yet, act at once. Sparrow (“Cancel Transaction (RBF)”) and Electrum (“Cancel (double-spend)”) can send the same coins back to you at a higher fee, which works unless the original confirms first (replace-by-fee, from Bitcoin Transactions Explained). A confirmed payment can’t be reversed. Report it to the police, and ignore anyone who offers to get it back for a fee.
- You suspect clipboard malware: stop using that computer for bitcoin until its system has been reinstalled. Words you only ever typed on the hardware wallet are still safe; any wallet whose keys lived on that computer is not, so move its funds from a clean device.
Check Your Understanding
1. An email from your hardware wallet maker’s real address says a flaw affects your device and asks you to install a “security app” that will move your wallet to safety. It passed your email provider’s checks. What do you do?
Answer
Don’t click. In September 2026 phishing emails really were sent through Trezor’s and BitBox’s newsletter service, so a genuine sender proves nothing. An app that “moves your wallet” will ask for your words, which go only on the hardware wallet. To check for a real issue, type the maker’s address yourself and read its security page and our advisories page.
2. You want to pay a friend again and copy the address from last month’s payment in your wallet history. It starts with bc1q and ends with the same four characters you remember. What’s the risk, and what should you do instead?
Answer
Address poisoning. Every address of that type starts with bc1q, and an attacker can match four end characters with about a million attempts, then plant the look-alike in your history with a tiny deposit. Ask your friend for a fresh address, compare the whole address on your hardware wallet’s screen with the one your friend shows you, and send a small test amount first.
3. You bought your hardware wallet from a reseller and have never typed your words anywhere but the device. Which scams in this lesson does that protect you from, and which not?
Answer
It protects you from fake apps, fake support and phishing sites, which all need your words typed elsewhere. It doesn’t cover a tampered device that copies the words off its own screen (the CryptoBilis case), address swaps, which you catch by comparing the address on the device’s screen with the recipient’s original, or a wrench attack, where privacy is the defence. Check our advisories page for your reseller and device, and buy your next one from the maker’s own store.