Last checked 31 October 2026. Every example below is from an official statement, regulator or law enforcement source, linked under each one. If anything here conflicts with the linked source, the source wins.
Scams aimed at company bitcoin rarely break the technology. They persuade a person to reveal recovery words, approve a payment, or pay a new address. The examples below are real and documented. The defences are dull and effective: a written payment routine, two people for every payment, and a rule that recovery words are never typed or spoken.
Five rules
- No genuine provider, auditor or police force will ask for recovery words. Anyone who does is a scammer.
- Contact the provider through details you already hold, not those in the message.
- Check every payment address on the signing device, by two people.
- Confirm any change of payment details by phone on a known number.
- Nobody can recover stolen bitcoin for an upfront fee.
Fake support and impersonation
Stolen customer data used for impersonation
Coinbase told the SEC that a criminal had paid contractors or employees in support roles outside the United States to take customer data from internal systems, including names, contact details and account data. Coinbase said no passwords or private keys were taken, and that the data could be used in social engineering attempts impersonating Coinbase. It estimated costs of about $180 million to $400 million, including voluntary reimbursement of customers who sent funds to the scammers.
Lesson: A caller who knows your details is not proof they are genuine. Hang up and use the contact details you already hold.
Source: SEC EDGAR: Coinbase Global, Form 8-K, 14 May 2025: Item 1.05 material cybersecurity incident.
Phishing for recovery words
Customer data leak followed by phishing
Ledger says a 2020 leak exposed the postal addresses and phone numbers of about 272,000 customers, and that phishing emails and texts followed, trying to get customers to reveal their 24 recovery words. Ledger says never to share the 24 words.
Lesson: Recovery words only ever go into the signing device itself, during a restore.
Source: Ledger: Message from the CEO on the 2020 customer data leak.
Source: NCSC: Phishing: spot and report scam emails, texts, websites and calls.
Disguised transactions
A signing request that was not what it seemed
The FBI says about $1.5 billion in virtual assets was stolen from Bybit. The Safe Ecosystem Foundation says a compromised developer machine was used to present a disguised transaction for signing. Bybit used an Ethereum multisig, but the lesson applies to any multisig.
Lesson: Each signer must read what the signing device itself shows, not the screen of the computer.
Source: FBI: Public service announcement, 26 February 2025: theft of about $1.5 billion in virtual assets from Bybit, Safe Ecosystem Foundation: Statement on the Bybit incident: compromised developer machine and disguised transaction.
Swapped addresses
Look-alike and replaced addresses
The FBI warns of scammers planting look-alike addresses in wallet histories, and Microsoft described Windows malware in 2026 that replaced copied bitcoin addresses with look-alikes.
Lesson: Use a saved address book and check every character on the signing device.
Source: FBI Denver: FBI warns of cryptocurrency token impersonation scam (look-alike addresses in transaction history), Microsoft Security Blog: Crypto Clipper uses Tor and worm-like propagation, 17 June 2026 (clipboard address replacement).
Business email compromise
The FBI reported more than $55 billion in exposed losses from business email compromise worldwide between October 2013 and December 2023: criminals posing as suppliers or executives to redirect payments.
Lesson: Confirm any change of payment details by phone, on a number you already hold.
Source: FBI IC3: PSA240911: Business email compromise, the $55 billion scam (11 September 2024), NCSC: Business payment fraud: respond and recover.
Our page on sending bitcoin safely turns these lessons into a routine.
Fake recovery services
Recovery scams
The FBI has warned of companies falsely claiming they can recover lost crypto, and of fictitious law firms contacting scam victims, sometimes claiming to work with the FBI or other agencies. It says victims lost more than $9.9 million to these fake law firms between February 2023 and February 2024. In the UK, the FCA warns about recovery room scams that target people who have already lost money.
Lesson: Report losses to Report Fraud in the UK (in Scotland, Police Scotland on 101) or the FBI's IC3 in the US. Do not pay anyone who contacts you offering recovery.
Source: FBI IC3: PSA230811: companies falsely claiming an ability to recover funds lost in cryptocurrency scams, FBI IC3: PSA240624: fictitious law firms targeting cryptocurrency scam victims, FCA: Recovery room scams, GOV.UK: Report Fraud: new service from City of London Police, replacing Action Fraud from 4 December 2025.
Source: Report Fraud (City of London Police): Mandate fraud, also known as payment diversion fraud, FBI IC3: Cryptocurrency fraud: how to report it.
Check a firm
In the UK, the FCA Warning List and register show whether a firm is known to be a scam or is registered. In the US, the FBI's IC3 publishes advisories and takes reports.
Source: FCA: ScamSmart: check a firm and the FCA Warning List, FBI IC3: Cryptocurrency fraud: how to report it.
Read next
- Sending bitcoin safely, a payment routine.
- Peer-to-peer buys and sales, counterparty and payment reversal risks.
- Security lessons, past incidents and what they teach.
- Key ceremony, setting up keys safely.
Sources
Primary sources only. Each link was checked on 31 October 2026. Rules change, so confirm the current version with your adviser.
- SEC EDGARCoinbase Global, Form 8-K, 14 May 2025: Item 1.05 material cybersecurity incident
- LedgerMessage from the CEO on the 2020 customer data leak
- NCSCPhishing: spot and report scam emails, texts, websites and calls
- FBIPublic service announcement, 26 February 2025: theft of about $1.5 billion in virtual assets from Bybit
- Safe Ecosystem FoundationStatement on the Bybit incident: compromised developer machine and disguised transaction
- FBI DenverFBI warns of cryptocurrency token impersonation scam (look-alike addresses in transaction history)
- Microsoft Security BlogCrypto Clipper uses Tor and worm-like propagation, 17 June 2026 (clipboard address replacement)
- FBI IC3PSA240911: Business email compromise, the $55 billion scam (11 September 2024)
- NCSCBusiness payment fraud: respond and recover
- FBI IC3PSA230811: companies falsely claiming an ability to recover funds lost in cryptocurrency scams
- FBI IC3PSA240624: fictitious law firms targeting cryptocurrency scam victims
- FCARecovery room scams
- GOV.UKReport Fraud: new service from City of London Police, replacing Action Fraud from 4 December 2025
- Report Fraud (City of London Police)Mandate fraud, also known as payment diversion fraud
- FBI IC3Cryptocurrency fraud: how to report it
- FCAScamSmart: check a firm and the FCA Warning List
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.