07
Everything That Goes Wrong Is Human
Imagine This
You get a message: a text, an email, a DM, or a phone call. It's from someone who seems to work for your exchange. They know your name. They reference a recent transaction. They are calling because they have detected unusual activity on your account, and they need to verify you are you before they can protect your funds. They sound professional. They sound in a hurry. They need just one piece of information (a code, a password, a single confirmation) and everything will be fine. You have ninety seconds to answer before the security timer locks your account.
The Bitcoin protocol itself has not been broken. In seventeen years, nobody has forged a valid signature, double-spent a confirmed transaction, or cracked the cryptography at the root of the system. Every dollar of bitcoin that has ever been stolen was stolen around the protocol, not through it. Someone tricked a person. Someone compromised an exchange's infrastructure. Someone intercepted a text. Someone kicked down a door.
In 2025 alone, that "around-the-protocol" ecosystem lost roughly $3.5 billion to scams, phishing, and theft, with social engineering driving more than half of it1. The rest of this section walks through the three attack shapes that account for most of those losses: what they look like, who they hit recently, and what the defending habit actually is. The rules at the end aren't a checklist to skim and forget. They're the defaults you leave running on your life.
Attack #1: Social Engineering, Tricking a Human Into Handing Over the Keys
The most common attack in Bitcoin has nothing to do with cryptography. It is convincing a person to give up the keys voluntarily. The attacker impersonates a support team, an exchange, a wallet company, a celebrity, a government agency, a friend, anyone whose authority the victim won't think to question in the moment. The goal is always the same: get the seed phrase, the password, the one-time code, the click.
A Real Story: The 2020 Twitter Hack
In July 2020, attackers compromised the Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Apple, and dozens more, using, it turned out, an internal Twitter customer-service tool. Within an hour, every one of those accounts was posting the same message: send any amount of bitcoin to this address and I'll send back double. In four hours, people sent over $120,000 in bitcoin. It was an obvious scam. It worked because the messages came from names the victims trusted. The lead attacker, Graham Ivan Clark, was seventeen years old. He was sentenced to three years in 2021 as a minor2.
The 2020 playbook is still running in 2026, and the tools have gotten sharper. AI voice cloning now lets attackers impersonate real support staff on the phone, convincing voices built from seconds of audio scraped from YouTube, podcasts, or social-media clips. The May 2025 Coinbase insider breach we named in Section 3 fed directly into a wave of these calls: attackers knew the victim's name, address, and which exchange they used, then called pretending to be Coinbase security, referenced real transaction details to build trust, and walked the victim into handing over one-time codes3. Hundreds of millions of dollars moved that way in 2025 alone.
The Seed-Phrase Recognition Rule
No legitimate company, support team, exchange, wallet manufacturer, firmware update, airdrop, tax agent, or recovery service will ever ask for your seed phrase. Ever. Not to verify you. Not to upgrade you. Not to help you. Not to process a refund. The existence of the request is the identification: "We cannot and will not ever ask for your seed phrase" is the only real support answer. Anything else is an attack.
Train yourself to recognize the shape, not just the red flags. The shape is anyone who needs your twelve or twenty-four words to help you. The red flags (urgency, authority, fear, a countdown timer, a strange email domain) come and go. The shape is permanent.
Attack #2: Digital Trickery, Swapping Your Address for Theirs
The second class is less showy but arguably more devastating, because it targets the exact moment you think you're being careful: sending bitcoin. Address poisoning and clipboard-hijacking malware both exploit the same fact: Bitcoin addresses are long strings of random characters that nobody memorizes. The attacker either seeds your transaction history with a nearly-identical address, or silently swaps whatever you copied with their own address the moment you paste. If you don't check, you send your bitcoin to them. Once confirmed, the transaction is irreversible.
A Real Story: The $50 Million Address-Poisoning Theft
In December 2025, a crypto user needed to send a large transfer. Like most people, they copied the recipient's address from a previous transaction in their own history, a habit that feels safer than pasting from an email or chat. But the attacker had been watching that wallet for weeks. They had sent a tiny "dust" transaction from a newly-generated address whose first six and last six characters matched the real recipient's exactly. The victim saw the address in their transaction history, verified the first and last characters, copied it, and sent. $49,999,950 transferred to the attacker in a single confirmation4.
The Hardware-Wallet-Screen Rule
For any transaction you care about, do not trust the address shown on your computer or phone. Trust only the address shown on your hardware wallet's own screen. The device displays the destination address from its own signing memory, not from whatever the browser or app is feeding it. Malware on the host machine can rewrite what you see on the host. It cannot rewrite what the device shows you.
Compare the first six and last six characters between what the device shows and what you intended. For anything above pocket money, pair the screen check with the test-transaction habit from Step 5 of Section 6: a few dollars first, confirmed, before the rest.
Attack #3: The Physical Threat, The $5 Wrench
The third attack class is the one most beginners underestimate, because it doesn't look like a Bitcoin attack. It looks like a home invasion, a kidnapping, a fake postal worker at the door. It's called the "$5 wrench attack" after a famous comic: why spend a million dollars on cryptography when you can spend five dollars on a wrench and hit the person until they hand over the keys?5
In 2023, there were 18 documented physical crypto attacks worldwide. In 2024, there were 24. In 2025, there were at least 25 by mid-year, a 75% year-over-year surge, with confirmed losses topping $40.9 million6. The trade press describes it as "a record year for wrench attacks." Roughly 45% begin with social engineering (fake postal workers, fake delivery drivers, fake government or military personnel at the door) before the physical phase begins.
A Real Story: David Balland, January 2025
David Balland is a co-founder of Ledger, the company that, arguably more than any other, built the modern hardware-wallet industry. In January 2025, Balland and his wife were abducted from their home in France. The attackers severed one of Balland's fingers and sent video to his business partner to accelerate the ransom demand. They wanted €10 million in crypto. French police located and raided the safehouse within days; Balland was recovered alive, and multiple suspects were arrested7. The man who built the product designed to protect bitcoin was attacked physically because his name was public.
Earlier the same decade, a family in British Columbia was attacked by men posing as postal workers, bound and waterboarded in their own home, and robbed of roughly $1.6 million in crypto8. The attackers knew the victims held bitcoin before they ever knocked on the door.
The Privacy Rule
Don't post your stack on social media. Don't tell strangers, or even casual acquaintances, how much bitcoin you own. Don't mention it at parties, on podcasts, or in group chats. Don't discuss large holdings over unencrypted channels. Don't let exchange-breached databases match your real name to a home address with a known bitcoin-holder profile.
This is the one rule that cannot be reversed. A seed phrase can be rewritten onto a new plate. A leaked holding amount cannot be un-leaked. Silence is part of the security posture.
Your Security Defaults
Every rule below was paid for in losses other people took so you don't have to. Treat them as the defaults that run in the background of your life as a bitcoin holder.
- Withdraw from exchanges fast. Buy, then move it to your own wallet the same day. Every story in Section 3 happened to people who intended to move their bitcoin "later."
- Verify addresses on the hardware wallet's screen. Trust the device, not the host machine. Send a test transaction first for anything above pocket money.
- Never share your seed phrase; recognize the shape, not just the red flags. The existence of the request is the identification.
- Keep your holdings private. Silence is armor.
- Use strong, unique PINs and passwords. Not your birthday. Not your bank PIN. Not reused from anywhere else.
- Plan for inheritance. The three-part plan from Section 6 (letter, backup, contact), set up this weekend.
The Prudent See Danger
"The prudent sees danger and hides himself; the simple go on and are punished."
Proverbs 22:3, repeated almost verbatim in 27:12
Scripture names wisdom this way: the wise one sees what's coming and takes cover. The foolish one walks past it and pays the price. The stories in this section are what "walks past it" looks like in 2025. The rules above are what "takes cover" looks like. Nothing in this lesson is paranoia; it's stewardship, and stewardship is biblical wisdom applied to the asset in your care.
The protocol has done its part for seventeen years. Now you do yours.
¹ Coinpedia, 2025 Becomes One of Crypto's Worst Years, coinpedia.org; Chainalysis, 2025 Mid-Year Crypto Crime Update (social-engineering share ~55.3% of 2025 losses), chainalysis.com.
² U.S. Department of Justice and Florida Department of Law Enforcement press releases on Graham Ivan Clark's 2021 sentencing; FBI case summary of the July 15, 2020 Twitter incident.
³ Coinbase insider breach coverage: BleepingComputer, May 2025, bleepingcomputer.com. AI voice-cloning in 2025 social-engineering attacks: Spacelift, Social Engineering Statistics, spacelift.io.
⁴ CoinDesk, December 2025, coindesk.com; clipboard-hijacking primer: Halborn, halborn.com.
⁵ xkcd #538, "Security," the origin of the "$5 wrench" formulation. Merkle Science primer: merklescience.com.
⁶ The Block, Record Year for Wrench Attacks, theblock.co; Decrypt, Grisliest Wrench Attacks of 2025, decrypt.co; BitPinas, 2025 Weekly-Average Threat, bitpinas.com.
⁷ French law enforcement reports on the Balland kidnapping, January 2025; Decrypt overview linked in source 6 above.
⁸ British Columbia family wrench attack, 2024, covered in multiple wrench-attack roundups including The Block's Record Year piece (source 6).