You can have the best hardware wallet in the world and your seed stamped in steel. Even so, a large share of Bitcoin losses don't come from technical failure. They come from people being tricked. A scammer doesn't break Bitcoin's cryptography. He convinces you to hand over the key or to send the money to the wrong address.
That's why this chapter covers privacy and scams together. The fewer people who know you hold Bitcoin, the less of a target you become.
No legitimate person will ever ask for your seed. Not me, not any wallet's support team, not an exchange, not a "recovery specialist." If someone asked, it's a scam. No exceptions.
Privacy is security, not hiding
Let me be clear about what privacy means in this guide. It means not exposing your wealth to strangers, so you don't become a target for scams, extortion, kidnapping or data leaks. It does not mean hiding assets from the tax authorities or the courts.
In Brazil, holding Bitcoin in self-custody is legal. And Bitcoin must be reported on your income tax return, in the Assets and Rights section, under the crypto-assets group. Other countries have their own reporting rules. You can be discreet with the world and fully compliant with the tax authority. The two go together. For the details of your situation, check with an accountant.
There is also no such thing as absolute anonymity in Bitcoin. The blockchain is public: anyone can see every transaction and the balance of every address. What protects you is that an address doesn't carry your name. Your privacy starts leaking when someone manages to link an address to you.
How your privacy leaks
KYC and customer database leaks
KYC (Know Your Customer) is the identity check exchanges are required to perform. You send an ID, a selfie, your address. It's a legal requirement and complying is the right thing to do. The risk is something else: companies get hacked. There have already been leaks of customer databases from exchanges and even from hardware wallet makers, with names, emails, phone numbers and home addresses. People on those lists become targets for phishing (fake messages that imitate well-known companies to steal data or money) and, in the worst case, physical threats.
What you can do: - Use an email address dedicated to Bitcoin matters that you use for nothing else. - Turn on two-factor authentication (2FA) with an authenticator app, not SMS. - When possible, have packages delivered somewhere other than your home, such as a pickup point. - Assume your account details will leak someday. Plan your security with that in mind.
Address reuse
Serious wallets generate a new address for every payment you receive, automatically. Always use a new one. If you reuse the same address and give it to several people, all of them can see its balance and full history. Someone who paid you once now knows how much you hold there.
UTXOs, explained simply
Your balance is not a single number. It's made of separate "coins" called UTXOs (Unspent Transaction Outputs). Every payment you receive creates a UTXO. If you received three times, you have three UTXOs, like three bills in your wallet.
When you pay someone, the wallet combines UTXOs to cover the amount and sends the change back to an address of yours. That has two practical effects:
- Privacy: combining UTXOs in one transaction shows the world they belong to the same owner. If one came from an exchange that has your ID and another came from a source nobody linked to you, now they're linked.
- Fees: the network fee is charged by the size of the transaction in bytes, not by the amount sent. More UTXOs as inputs means a bigger transaction and a higher fee.
Wallets such as Sparrow, Electrum and Nunchuk offer coin control: you choose which UTXOs to spend and can label each one ("came from exchange X," "client payment"). Labeling from day one helps a lot later.
Fees, also explained simply
Each block has limited space. Whoever pays more per byte (sat/vB, satoshis per virtual byte) gets in first, and when the network is busy, fees go up. That's why very small UTXOs can cost more to spend than they're worth. Avoid receiving in dozens of tiny pieces.
The most common scams
Seed pre-printed in the box
You buy a hardware wallet and inside there's a card with 24 words "already generated for you." It's a scam. The seed must be generated by the device itself, in front of you, during first setup. Whoever printed that seed has access to everything you deposit. So: buy only from the manufacturer or an official reseller, never used, and check the tamper seal and the firmware.
Fake support
You post a question on social media and soon an "official support" account shows up in your DMs. Polite and quick, in the end it asks for your seed to "sync" or "validate" your wallet. Real support doesn't DM you first and never asks for a seed. There are also fake "recovery services" promising to get stolen bitcoin back for a fee. It's a second scam aimed at people who already fell for the first.
Fake websites and fake apps
Scammers buy search ads pointing to sites identical to well-known wallets. You download the fake program, type in your seed and lose everything. Protection: type the official website address yourself and bookmark it. Download apps only from there. When the project publishes file signatures, verify them.
Fake firmware updates
An email or pop-up says your wallet needs an urgent update, with a link. Real updates come only from the manufacturer's official app or website, which you open from your bookmark, and they are confirmed on the device's own screen. A serious wallet never asks you to type your seed into a computer or phone to update.
Email phishing after a data leak
After a customer database leak, very convincing emails arrive, with your name and even your wallet model, saying your account has been compromised and you need to "migrate your funds" or "confirm your seed." Knowing your name and what you bought proves nothing. Don't click. Go to the official site through your bookmark.
Address poisoning
The scammer looks at your public history and creates an address that starts and ends with the same characters as an address you use. Then he sends you a tiny amount from it, so that address shows up in your history. The next time you copy "that usual address" from your history, you might copy the fake one. This scam is more common on other networks, but it also happens on Bitcoin.
Protection: never copy an address from your transaction history. Get it straight from the source every time and check the whole address, not just the beginning and the end.
Clipboard-swapping malware
Some malware watches the clipboard on your computer or phone. When you copy a Bitcoin address, it swaps it for the scammer's. You paste without noticing.
The strongest defense is a hardware wallet: it shows the destination address on its own screen, which the computer's malware doesn't control. Check it on the device screen, character by character, before confirming. The same goes for receiving: check on the hardware wallet screen that the address matches the one you're about to give to the person paying you.
Everyday discretion
The most dangerous piece of information is "that person has a lot of Bitcoin." A few rules I follow and recommend:
- Don't tell anyone how much you hold. Not friends, not group chats, not social media.
- Don't post screenshots of balances, wallets or transactions.
- Don't wear clothes, stickers or license plates that scream "I own crypto."
- Don't talk about amounts in public places.
- If you're known for talking about Bitcoin, use a passphrase and a decoy wallet, as covered in the chapter Passphrase and Protection Against Coercion.
Checklist
- I use an email dedicated to Bitcoin, with app-based 2FA.
- I use a new address for every payment and never copy addresses from my history.
- I check the entire address on the hardware wallet screen before sending or receiving.
- I only download wallets and firmware from the bookmarked official website.
- I know no legitimate person asks for my seed, and I don't answer "support" in DMs.
- I label my UTXOs and understand that combining them links their origins.
- I don't disclose how much I hold, and my Bitcoin is reported for tax purposes.