How people actually lose bitcoin

Some product links in this guide are affiliate links. How that works.

Bitcoin itself is very hard to hack. Almost every loss comes from something simpler: a missing backup, a convincing scam, or a skipped check. Here are the common ones and how to avoid each.

1. Lost or damaged backups

This is the most common way people lose coins for good. The device breaks, and then they find the seed words were on paper that got thrown out, burned or soaked.

Prevent it:

• Back up the seed on stainless steel for anything long-term. See seed backups.
• Keep the backup somewhere separate from the device.
• Know exactly where it is. Check on it once a year.

2. Forgotten passphrase

A passphrase (the “25th word”) adds strong protection. It also adds a new way to lose everything. There is no reset, and a typo opens an empty wallet without warning.

Prevent it:

• Skip the passphrase until you are comfortable with the basics.
• If you use one, back it up separately from the seed and test it by restoring.

3. Untested recovery

Many people discover their backup is wrong only when they need it. A word was misspelled, two were swapped, or the wallet used a different setting they did not write down.

Prevent it:

• Before you move real money in, wipe the device and restore from your backup.
• Confirm the same addresses appear.
• Rehearse the whole thing for free on signet.

If you have never restored from your backup, you do not know that it works.

4. Phishing and fake support

Scammers pose as wallet companies, exchanges or “recovery services.” They send emails, texts, social media DMs and even physical letters. They all want the same thing: your seed phrase.

Common versions:

• “Your wallet has been compromised. Verify your seed to secure it.”
• “We noticed a problem with your account. Reply with your recovery phrase.”
• A friendly “support agent” who replies to your public question on social media.
• Fake “wallet recovery” sites that rank high in search results.

Prevent it:

• No legitimate company will ever ask for your seed phrase. Anyone who does is stealing.
• Never type your seed into a website, app or form.
• Do not trust DMs offering help. Real support does not reach out first.
• Type wallet and exchange addresses yourself or use a saved bookmark. Do not click links in emails.

5. Fake apps and tampered devices

Fake wallet apps appear in app stores and as search ads. Hardware wallets bought from resellers have been tampered with, sometimes arriving with a “recovery sheet” already filled in.

Prevent it:

• Download wallet software only from the official site. Verify signatures where offered.
• Buy hardware wallets directly from the maker, not from marketplaces or resellers.
• If a device arrives with seed words already printed or filled in, do not use it. A real device always generates a new seed for you.
• Check the packaging and follow the maker’s authenticity check.

6. Address poisoning and clipboard malware

Two tricks target the moment you paste an address.

• Clipboard malware silently swaps the address you copied for an attacker’s address.
• Address poisoning puts a lookalike address in your transaction history, one that matches the first and last few characters of an address you use. You copy the wrong one later from your history.

Prevent it:

• Check the full address, not just the start and end.
• Copy receive addresses from the wallet each time, not from old transaction history.
• Send a small test amount first for a new destination.

7. Not verifying the address on the device

Your computer can be compromised. Your hardware wallet’s screen is the part you can trust. If you only look at addresses on your computer, malware can show you one address while the coins go to another.

Prevent it:

• When receiving, show the address on the device screen and compare it to what the computer shows.
• When sending, check the amount and destination on the device before you approve.
• Air-gapped devices like Coldcard Q and Keystone 3 Pro, or a free setup using Sparrow with an offline machine, make this check a normal part of every transaction.

8. Talking about your holdings

The “$5 wrench attack” is a joke about a real problem. Strong encryption does not help if someone threatens you in person. Physical robberies and home invasions targeting bitcoin holders do happen.

Prevent it:

• Do not share how much bitcoin you hold, online or in person.
• Avoid posting screenshots of balances or hardware.
• Keep the backup somewhere a thief would not easily find, and not labeled.
• For larger amounts, 2-of-3 multisig with keys in different places means no single location can be forced to give up the coins.

9. Leaving coins on an exchange

When your bitcoin sits on an exchange, the exchange holds the keys. You have a promise from a company. Exchanges have been hacked, frozen withdrawals and gone bankrupt. Customers have waited years to get part of their money back.

Prevent it:

• Use an exchange to buy, then withdraw to a wallet you control.
• Pick a service that lets you withdraw easily. See Not your keys for why this matters.

10. No plan for after you

If something happens to you and nobody knows how to recover your bitcoin, it is lost. This is a slow, quiet loss, and it is very common.

Prevent it:

• Write a simple letter of instructions. See inheritance planning.

The short version

• Steel backup, kept apart from the device, tested by restoring.
• Nobody ever gets your seed phrase. Not support, not an app, not a website.
• Buy hardware direct. Download software from official sites.
• Check every address on the device screen.
• Keep quiet about what you hold.
• Withdraw from exchanges.
• Leave instructions for your family.

Next steps

• Build your setup with Four ways to build a cold wallet or the interactive checklist.
• Rehearse everything for free with practice on signet.