Is bitcoin safe? The protocol, the custody risk and the scams, by the documents
Is bitcoin safe?
Bitcoin's protocol is secured by proof of work and has produced 971,395 blocks since January 2009. The money people lose goes through custody failures and scams: the FBI's IC3 recorded 181,565 crypto-related complaints and $11.366 billion in losses in 2025, about $7.2 billion of it investment fraud.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
Bitcoin's ledger is hard to attack: it has added 971,395 blocks since 3 January 2009, each sealed by proof of work. People lose bitcoin anyway, almost always through the two layers around the protocol, custody and scams. The FBI's IC3 recorded 181,565 complaints involving cryptocurrency in 2025, with $11.366 billion in reported losses.
Is bitcoin safe, then? It depends which of three things the question means. The 2025 IC3 annual report, the whitepaper, the FBI's Bybit notice and two exchanges' own incident reports were read on 14 October 2026. Nothing here is a view on bitcoin's price, which is a separate risk and not covered.
Is bitcoin safe at the protocol level?
The whitepaper states the condition. The system "is secure as long as honest nodes collectively control more CPU power than any cooperating group of attacker nodes." The record of transactions "cannot be changed without redoing the proof-of-work." The chain tip read from mempool.space on 14 October 2026 was block 971,395. That is the evidence for the protocol: a public, unbroken record anyone can check with a node.
What the protocol does not do is protect a holder from themselves. A payment signed with the right key is valid, whether the holder meant it or a thief did, and there is nobody to reverse it.
What are the three kinds of bitcoin risk?
Protocol, custody and scams, and only the first is about bitcoin itself. A protocol failure would mean rewriting confirmed history, and nobody could reverse it; no successful rewrite of confirmed history is recorded in the sources read here. A custody failure at an exchange, such as Bybit, WazirX or CoinDCX below, is reversed only if the exchange can cover it. A custody failure in self-custody, a leaked seed phrase or a compromised device, has nobody to reverse it. A scam, where the holder signs the payment on false pretences, is in practice final too.
How much was lost to crypto scams in 2025?
$11,366,669,732 across 181,565 complaints with a cryptocurrency nexus, per the 2025 IC3 report, a 22% rise in losses on 2024. These are crypto figures, not bitcoin-only figures; the IC3 category covers any report with "some reference to virtual currency". By crime type, the five rows below are taken from the report's loss table on page 55:
| Crime type, crypto nexus, 2025 | Complaints | Losses |
|---|---|---|
| Investment | 61,559 | $7,277,868,919 |
| Tech or customer support | 17,355 | $1,226,298,080 |
| Personal data breach | 13,486 | $939,398,686 |
| Confidence or romance | 5,925 | $394,787,515 |
| Extortion | 23,797 | $63,195,612 |
The report prints two figures for crypto investment fraud. The page 55 table above gives $7,277,868,919; the page 53 summary gives 61,559 complaints and $7.228 billion, and page 11 rounds it to $7.2 billion. The report does not explain the gap, so both are shown here.
The report puts the average crypto loss at $62,604, and says 18,589 complainants lost more than $100,000. People aged 60 and over reported $4,432,224,488 of the crypto total in the age chart on page 52; the 60+ section on page 46 gives $4,347,081,557 for the same descriptor. Crypto ATMs and kiosks drew 13,460 complaints and $389 million.
Then comes the second wave. Recovery scams, people promising to get stolen money back, drew 10,516 complaints and $1.4 billion in 2025, and the report notes those losses "may also include losses experienced from previous scams". The FBI's July 2026 notice warns of scammers posing as the IC3 itself. The legitimate routes are on the crypto scam recovery page.
Are exchanges safe for holding bitcoin?
An exchange holds the keys, so its security is the holder's security. Three incidents from primary sources:
the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit
The FBI attributes the 21 February 2025 theft to North Korea, under the name "TraderTraitor". WazirX's own report says that "On July 18, 2024, WazirX experienced a cyber attack targeting one of our multisig wallets", "resulting in the theft of digital assets exceeding $230 million", and the exchange went through a court restructuring afterwards. CoinDCX reported that on 19 July 2025 "one of our internal operational accounts" was compromised, with "~$44M USDT" moved out, and states "No customer assets were affected".
The outcomes differ, and that is the custody risk in one line: what happens to customer balances after a hack depends on the exchange's reserves and its terms, not on bitcoin. Each case, with the exchange's terms, is on its register entry: Bybit, WazirX and CoinDCX.
Is self-custody safer than an exchange?
It swaps one risk for another. Self-custody removes the exchange from the chain of trust and puts the whole job on the holder: the seed phrase, the device and every signature. The investment, tech-support and recovery scams in the IC3 table all work on self-custody holders, because the holder is the one who signs. The trade-offs are on cold vs hot wallets, the steps on the self-custody safety checklist, and why nobody legitimate asks for the words on what is a seed phrase.
Quick answers
Is bitcoin safe?
The protocol has run since January 2009 on proof of work. The losses are in custody and scams: the FBI's IC3 logged $11.366 billion in crypto-related losses in 2025.
Can bitcoin be hacked?
The whitepaper says the ledger is secure while honest nodes control more CPU power than attackers. Exchanges and wallets get hacked: the FBI attributes a $1.5 billion Bybit theft to North Korea.
Can stolen bitcoin be recovered?
Not by the network: a signed transfer is final. The FBI says "IC3 will never ask for payment to recover lost funds", and recovery scams cost victims $1.4 billion in 2025 per the IC3. See the crypto scam recovery page.
Is a bitcoin ETF safer than holding bitcoin?
It replaces self-custody with a regulated custodian and a sponsor fee. The funds and custodians are on what is a bitcoin ETF; what stands behind the coin is on what is bitcoin backed by.
Sources
- FBI Internet Crime Complaint Center, 2025 IC3 Annual Report, retrieved 14 October 2026
- FBI public service announcement I-022625-PSA, North Korea Responsible for $1.5 Billion Bybit Hack, 26 February 2025, retrieved 14 October 2026
- WazirX, cyber attack day-wise report, retrieved 14 October 2026
- CoinDCX, incident report July 19 2025, retrieved 14 October 2026
- Satoshi Nakamoto, Bitcoin, A Peer-to-Peer Electronic Cash System, abstract and section 1, retrieved 14 October 2026
- mempool.space API, chain tip height 971,395, retrieved 14 October 2026
- mempool.space API, genesis block timestamp 3 January 2009, retrieved 14 October 2026
- FBI public service announcement I-072026-PSA, FBI Warns of Scammers Impersonating the IC3, 20 July 2026, retrieved 14 October 2026
- WazirX, Singapore court sanctions restructuring scheme, as recorded on the exchange register 2026-10-09
- CryptoGuardz exchange register, incident records
- CryptoGuardz crypto scam recovery page
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.