Phishing + Social Engineering

Phishing and social engineering bypass technical security entirely — they exploit your impulses, your trust, and your tiredness. Nothing in your setup stops a message you act on yourself, which is why this lesson is about recognizing manipulation and verifying independently rather than about better software.

The most common patterns

Fake support PM. Someone messages you claiming to be from a wallet, exchange, or the forum staff. They ask for verification information that lets them take over your account.

Urgency manipulation. "Your account will be frozen in 24 hours unless…" The clock is fake; the panic isn't.

Trusted-context impersonation. A clone account of someone you know PMs you with a "great opportunity" or "small favor."

Drainer link. An ad, a forum post, or a PM links to a website that looks legitimate but is designed to drain wallets that connect to it.

Helpful-stranger. Someone offers free help with a wallet issue, then walks you through a "recovery" that funnels your seed to them.

Why they work

You're not stupid. You're human. The attacker times the message for when you're tired, distracted, or already stressed. The script is refined by thousands of prior victims. The fake site is pixel-perfect.

The defense isn't being smart. It's having pre-committed rules that don't bend under pressure.

Pre-committed rules

Bitcoin-specific phishing

Bitcoin has no approval mechanism to abuse, so attacks against Bitcoin users work by changing where a payment goes or by getting you to run the wrong software. These are the ones a forum member actually meets:

• Clipboard replacement — malware watches the clipboard and swaps the address you copied for the attacker's. The paste looks normal; only the characters differ.
• Counterfeit wallet installers — a real-looking download page, an unofficial mirror, or a search advert serving a modified binary. Download from the project's own site and verify the signature before installing.
• Malicious QR codes — a code posted in a thread, sent in a PM, or swapped on a payment page encodes an address that is not the one you were told. Decode it and read the address before sending.
• Altered payment requests — an invoice, escrow instruction, or address edited after you agreed the deal, or re-posted by an impostor account. Confirm any address change through a channel you already trust, never through the message that announced it.
• Manipulated PSBTs — someone sends you a partially signed transaction to "just sign." Inspect the outputs on your signing device rather than in the sender's interface.

Defense, for all five: cross-check the recipient address character-by-character on the device that signs, and treat a changed address as an attack until proven otherwise.

If your work takes you onto smart-contract networks

If bounty or campaign work takes you onto smart-contract networks, the authorization model is different from Bitcoin's, and that difference is where the expensive mistakes happen. This section applies only in that case.

The pattern: you click a link to "claim airdrop" or "verify wallet." A signature prompt appears asking you to sign what looks like a benign message. On those networks the signed message can be a standing approval that lets someone move your tokens later, which is not something a Bitcoin signature can do.

Defense:

• Read every signature prompt slowly
• If it mentions "approve", "permission", "operator", or "spender" — stop and find out what it grants
• Use a separate low-value wallet for any new site you have not used before
• Disconnecting a site later does not undo an approval you already granted; that has to be revoked separately

After a near-miss

If you almost fell for one:

1. Take a screenshot of the attack for your records
2. Report it (forum's report system, exchange support, Twitter report)
3. Tell others — warning a peer is high-leverage harm reduction
4. Reflect on what almost worked so you spot the next iteration