Scams aimed at holders

After this lesson you can: recognise the six shapes a scam takes once you hold your own keys, and apply the rule that beats all of them.

The Your first bitcoin course covered scams aimed at buyers: giveaways, romance, Ponzis. Holders of self-custodied bitcoin are targeted differently.

The shapes

Fake support. You post a question in a forum; a "support agent" DMs you offering help and asks for your seed, or to install remote-access software, or to "validate" your wallet on a site. Real support never does any of these.
Fake updates. An email says your signer needs an urgent firmware update, with a link. The link installs malware or asks for your seed. Update only from inside the official app or by typing the maker's site yourself, and verify the file (lesson 7). Real advisories, like Coinkite's in 2026, are posted on the maker's own site and never ask for your words.
Tampered hardware. A device from a reseller or marketplace that arrives with a seed card "for your convenience", or with modified firmware. Buy direct; generate your own seed.
Dust and address poisoning. A tiny deposit from an address that mimics yours, hoping you copy it from your history; or dust sent to link your addresses when you spend it. Do not spend dust; compare whole addresses.
"Connect your wallet." Sites that ask you to connect or sign a message to claim an airdrop or verify ownership. On Bitcoin, signing a message is mostly harmless, but these sites are phishing for seeds or pushing malware.
Clipboard hijackers. Malware that swaps the address you paste. Confirm on the signer's screen.

The rule, again

Table of six scams aimed at holders, the tell for each, and the defence. — Six shapes, one rule: nobody legitimate needs your seed.

Nobody legitimate needs your seed, your private keys, or remote access to your computer. Anyone creating urgency is the attacker. Slow down, close the message, and go to the official source you typed yourself.

Nobody legitimate needs your seed phrase, your private keys, or remote access to your computer. — The whole lesson in one line.

Course checklist: what you can now do

Tick each one you have actually done. The course is finished when they are all ticked, not when the quiz is.

01Your seed exists on paper or metal, verified by a restore, in a place you chose on purpose
02You have received and sent from an air-gapped signer and confirmed an address on its screen
03The software you run was verified by hash and signature
04Your threat model is written in four lines and the first fix is done
05A letter of instruction exists, without the words in it

MINI CHALLENGECount the asks

In the last month, how many messages, emails or DMs have asked you to click a link, update a wallet, or verify something? (Any number.)

messages

CHECK YOURSELF

1/3 A hardware signer arrives with a card showing a seed phrase already filled in. What is it?A convenience feature offered by some resellersA scam; the seller knows the keysStandard packaging for devices sold in some countries

2/3 What should you do with an unexpected tiny deposit?Spend it quickly so that it clears out of the walletLeave it; never combine it with your other coinsSend it back to the address it came from

3/3 Who legitimately needs your seed phrase or remote access?Only the wallet manufacturer's support team, when they verify youNobody at all; any request for them is a scamOnly your exchange, when it is carrying out an annual audit

pick an answer for each question

The shapes

The rule, again

Course checklist: what you can now do

SOURCES