Privacy & security
Almost nobody loses bitcoin to broken cryptography. They lose it to a convincing message, a reused password, a phone number ported onto somebody else's SIM, or an address quietly swapped in a clipboard. This section is the vocabulary of how that actually happens.
The attacks split into two families. Some target you: phishing, SIM swap, address poisoning, and the long confidence scams that end with a fake trading screen showing a balance that was never there. Others target the chain: dusting attacks that tag your coins so they can be followed, chain analysis that follows them, and at the far end a 51 percent attack that rewrites recent history.
Privacy and security are different problems and the terms get mixed up constantly. Coin control and coinjoin are privacy tools; they decide what an observer can learn. Two factor authentication and hardware signing are security tools; they decide who can spend. A perfectly private wallet with a weak password still gets emptied.
Proof of reserves sits between the two, and belongs here rather than under exchanges, because it is a claim you are being asked to verify rather than a product you are being sold. Read it before deciding how much to leave on any platform.
26 terms. Last reviewed 2026-09-07.
Terms in Privacy & security
- 51% attackalso Majority attack, 51 percent attackA 51% attack is an attempt to rewrite recent bitcoin history by controlling most of the network's mining power, letting the attacker reverse their own recent payments.
- Address poisoningalso Address spoofingAddress poisoning is a theft trick where a scammer sends you a worthless transaction from an address that mimics one you already use, hoping you copy theirs from your history.
- Chain analysisalso Blockchain analysisChain analysis is the practice of reading the public ledger to group addresses into wallets and attach real names to them, using clustering heuristics plus data from exchanges.
- Clipboard malwarealso Clipper malwareClipboard malware sits on an infected computer or phone and silently replaces any bitcoin address you copy with one belonging to the attacker, moments before you paste it.
- Coin controlCoin control is the wallet feature that lets you choose exactly which of your existing coins get spent in a transaction, instead of letting the wallet pick for you.
- CoinJoinCoinJoin is a single bitcoin transaction that several people build together, each putting in coins and taking out equal-sized amounts, so no observer can say which output belongs to which input.
- Double spendalso Double spendingA double spend is an attempt to make the same bitcoin pay two different people, by getting a second transaction that spends the same coins confirmed instead of the first.
- DustDust is a coin so small that spending it would cost more in transaction fees than the coin is worth, which makes it economically stranded in your wallet.
- Dust limitalso Dust thresholdThe dust limit is the smallest amount a bitcoin output can hold before nodes refuse to relay the transaction that creates it, currently 546 satoshis for a legacy address.
- Dusting attackalso Dust attackA dusting attack sprays tiny payments across thousands of addresses so the sender can watch which ones later get spent together, linking separate addresses to a single owner.
- Exit scamAn exit scam is a platform that operates normally, builds up customer deposits, and then vanishes with them, usually behind a wall of withdrawal delays and technical excuses.
- MergeA merge is a transaction that spends coins from two or more of your addresses at once, publicly announcing that those addresses share a single owner.
- Merge avoidanceMerge avoidance is the practice of never spending two of your coins in the same transaction, keeping the different parts of your wallet from being publicly tied together.
- Payjoinalso P2EP, Pay-to-endpointPayjoin is a payment where the person receiving the coins quietly adds one of their own inputs to your transaction, so the amount on chain no longer matches the amount you actually paid.
- PhishingPhishing is a fake message or website built to look like your exchange, wallet, or hardware wallet vendor, so that you hand over a password, a code, or your seed phrase.
- Pig butchering scamalso Romance investment scamA pig butchering scam is a long confidence fraud where someone you meet online spends weeks building trust, then steers you into a fake crypto investment platform that pays out nothing.
- Proof of reservesalso PoRProof of reserves is an exchange publishing cryptographic evidence that it actually holds the coins it owes customers, usually a Merkle tree of balances plus signatures from its wallets.
- Pseudonymityalso PseudonymousPseudonymity means your bitcoin addresses stand in for your name rather than hiding it: nothing on the ledger says who you are, and nothing forgets what you did.
- RehypothecationRehypothecation is a custodian lending out, pledging, or trading the bitcoin you deposited, so the coins backing your account balance are working somewhere else entirely.
- Rug pullA rug pull is a token launch whose creators drain the trading liquidity or dump their own reserved supply, leaving buyers holding something with no market to sell into.
- Silent paymentsalso BIP352Silent payments let you publish one reusable address that never appears on the blockchain, because the sender uses it to compute a fresh, unlinkable destination for every payment.
- SIM swapalso SIM swapping, SIM jackingA SIM swap moves your phone number onto a criminal's SIM card, handing them every SMS code and password reset that your exchange account and email depend on.
- Social engineeringSocial engineering is the craft of getting a person to do the attacker's work for them: approving a transfer, reading out a code, or bypassing a rule they were trained to enforce.
- Supply chain attackA supply chain attack reaches you through something you already trust: the wallet update you installed, the code library inside it, or the device a reseller shipped.
- Two-factor authenticationalso 2FATwo-factor authentication makes an account require a second proof besides your password, so a leaked or guessed password on its own no longer opens your exchange account.
- UTXO consolidationalso ConsolidationUTXO consolidation is the housekeeping spend that sweeps many small coins in your wallet into one larger coin, paid for at today's fee rate so tomorrow's spend is cheaper.
The other 13 sections
- BasicsWhat bitcoin is, what a satoshi is, and the handful of ideas the rest of the glossary is built on.
- Addresses & keysWhere coins get sent, what a private key actually controls, and how one seed produces thousands of addresses.
- Wallets & custodyHot, cold, custodial and multisig, and what each one changes about who can move your coins.
- Transactions & feesWhat a bitcoin transaction is made of, why it costs what it costs, and how to unstick one.
- Buying & exchangesOrder types, spreads and fee schedules: the vocabulary an exchange uses while it is charging you.
- Markets & investingMarket cap, volatility and spot ETFs. The language of price, without the price predictions.
- Mining & consensusHow new blocks get made, what difficulty adjusts, and why the rules hold with nobody in charge.
- Protocol & upgradesSegWit, Taproot, soft forks and BIPs: how bitcoin changes and who gets to decide.
- Lightning & layer 2Payment channels, invoices and routing, for moving bitcoin without paying for space in a block.
- Regulation & taxKYC, the Travel Rule, MiCA and capital gains: the rules that reach your account and your tax return.
- Culture & historyMt. Gox, the genesis block, HODL, and the events and slang that shaped how people talk about bitcoin.
- Nodes & softwareBitcoin Core, full nodes, pruning and RPC: the software that enforces the rules.
- Developer referenceP2P message types, opcodes and script terms: the field names you meet reading bitcoin code.
Frequently asked questions
What actually takes people's bitcoin?
Almost never broken cryptography. It is a convincing message, a reused password, a phone number ported onto somebody else's SIM, or an address quietly swapped in the clipboard. The vocabulary in this section is the vocabulary of those attacks.
Is bitcoin anonymous?
No. Every transaction is public and permanent, and analysis firms link addresses to people for a living. It is pseudonymous at best, and an exchange that verified your identity has already tied your name to whatever you withdrew from it.
What is address poisoning?
An attacker sends you a tiny payment from an address that resembles one you have used, hoping you copy it out of your history next time you pay. Check the whole address rather than the first and last few characters, and the trick fails.
Does coin control matter for an ordinary holder?
Less than for someone with something to hide, but it is not only a privacy tool. Choosing which coins you spend also decides what you pay, because every input a transaction includes is charged for at the current fee rate.