What are the main threats to a self-custody wallet, at home and online?

Fake support and fake websites

ethereum.org calls recovery phrase phishing one of the most common scams.¹ In a support scam, crooks pose as staff of a wallet, exchange or blockchain. They find people asking for help in public chats, then message them privately.² As a general rule, real staff never contact you through private, unofficial channels.²

In 2025, the FBI received 17,355 complaints about tech or customer support fraud involving crypto. Reported losses were about $1.23 billion.⁶ The FBI notes its figures can change as cases are reviewed.⁶

Some phishing emails link to fake websites that ask you to enter your recovery phrase.² ethereum.org suggests bookmarking a web wallet's site, and always checking you are on the right website, especially after clicking a link.^7,2

Your computer and phone

Bitcoin.org warns that any computer connected to the internet is vulnerable to malicious software.³ Some phishing emails try to get you to install such software.² A hacked computer can also show a changed address on screen. That is why one device maker says to check addresses on the device itself.⁸

Fake apps are another route in. One maker says to download its app only from its own website or the official app stores. That holds even if "support" says it is urgent.⁹ Browser extensions can also turn risky: some update themselves, so a safe one can later add harmful code.²

Your phone number

In a SIM swap, criminals get your mobile number moved to a SIM card they control. Then your calls and texts go to them.¹⁰ They can use text-message codes to reset your passwords and take over accounts, such as email and crypto accounts.¹⁰

ethereum.org says two-factor login by text message is open to this attack.² The FBI suggests stronger methods, such as physical security keys or authenticator apps.¹⁰ In 2025, the FBI received 971 complaints about SIM swaps.⁶

At home

• One event, one place. A backup kept in only one place can be lost to a single event.³
• Prying eyes. One maker says to enter your PIN out of sight of others.⁴
• A swapped device. Someone could steal your device and leave a fake one that sends your PIN to them. One maker suggests signing the back of your device and checking it before each use.⁸

Violent theft

Some criminals use force. In September 2024, US courts sentenced 12 men over one such scheme. It stole over $3.5 million through SIM swapping and violent home invasions.⁵ In one case, they first broke into a couple's email and watched their home for several days. Then they forced the man to give them access to his computer and exchange account.⁵

Mastering Bitcoin said in 2023 that one Bitcoin contributor had recorded over 100 physical attacks on people thought to own crypto.¹¹ The FBI suggests not advertising on social media that you own crypto.¹⁰ The SEC adds: don't tell anyone the amount or types of crypto you have.¹²

A BIP-39 passphrase can hide funds in a second wallet, since every passphrase opens a valid wallet.¹³ But Mastering Bitcoin warns that an attacker can't tell when you have revealed everything, so they may keep up the pressure.¹¹