Fake apps, fake support

Thieves rarely break bitcoin's rules. They get your keys, or get you to send to their address without noticing. Nearly every method below works by tricking a person, which is good news: a few habits stop most of them.

Fake wallet apps and sites

Copies of real wallet apps appear in app stores and in search ads, with the same name and logo. They work at first; then the coins disappear, because the app sent your backup words to the thieves. Get a wallet from its maker's own website, typed in yourself, or from the store link that site gives.

Fake support

Post a question about a wallet or exchange online and "support agents" appear in your messages within minutes, or send you to a form to "validate", "sync" or "restore" your wallet. The form asks for your seed phrase. Real support doesn't message you first, and no one, ever, needs your words. See seed phrases and backups.

Phishing

Emails and texts that look like they come from your exchange or wallet maker: a security alert, a required update, a prize. The link leads to a copy of the real site. People who have bought hardware from a company whose customer list leaked sometimes receive convincing letters or even fake devices. Go to the site yourself rather than following a link.

Address swaps

Clipboard malware	Malicious software watches for a copied bitcoin address and swaps it for the attacker's just before you paste.
Address poisoning	A tiny payment arrives from an address made to start and end like one you have paid before. Later you copy it from your history by mistake.

The defense against both is the same. Copy the address from the person's own screen, message or QR code each time, never from your history. Before you confirm, compare the whole address with the original, or at least the start, the end and a good stretch of the middle. For large amounts, send a test first and ask the receiver to confirm it arrived. See sending and receiving.

"Seed phrase generators" and "wallet finders"

Search for seed phrases and you will find tools that claim to generate phrases for wallets that already hold bitcoin, or to find "lost" wallets. They don't work: the number of possible phrases is so large that a random guess will never land on a used wallet. Such tools exist to take a fee, to collect phrases people type in, or to install malware. The same goes for lists of "leaked" seed phrases with balances: the coins in them are bait, usually arranged so that anything you send to pay a fee is taken.

Keys kept online

Backup words saved as a photo, a note, an email or in cloud storage are only as protected as that account. When the account is broken into, the coins go with it.