You know that moment when you play a song for your friends, and they’re like “ehh… it’s okay, I guess?” – but a week later they’re humming it under their breath, and next thing you know it’s on their gym playlist?

Yeah. This I knew you’d come around feeling is undefeated.

And it’s kind of how it feels watching US states slowly start understanding Bitcoin.

The newest state to officially hit play: Texas.

Governor Greg Abbott signed off on a bill to add Bitcoin to the state’s strategic reserves.

So now Texas joins Arizona and New Hampshire in the SBR club.

And who else is tapping their foot to the Bitcoin beat?

Well, a bunch of state Bitcoin reserve proposals have flopped.

But there are still a few holding on in the queue:

• Massachusetts;

• Michigan;

• Ohio;

• Rhode Island;

• And North Carolina.

No guarantees – but keep your headphones charged just in case.

Bad cat

Pop quiz time: there’s this thing called SparkKitty. Purely based on vibes, what do you think it is?

A) A cursed version of the Nyan Cat

B) The latest toy every iPad kid wants

C) A furry Twitch streamer

Got your guess?

… Too bad. It was a trick question. It’s D) None of the above.

SparkKitty is actually a malware recently discovered by the cybersecurity firm Kaspersky.

And no, it’s not cute.

It hides inside fake or modified apps (like TikTok mods, casino games, or crypto apps), and it’s been found on both Android and iOS.

On iPhones:

It hides inside fake versions of legit developer tools like AFNetworking or Alamofire – normally used to help apps connect to the internet. Attackers modify them to launch malware as soon as the app opens.

And to get around Apple’s App Store checks, they use something called an Enterprise profile – a system meant for companies to test apps on employee phones. It lets apps be installed directly, without Apple’s usual security reviews.

On Android, the malware shows up in two main ways:

Some versions are fake or modified apps with malicious code written in Java or Kotlin;

Others use a tool called Xposed, which lets the malware hide inside real apps and mess with what they do – without changing how they look.

Once installed, the malware:

• Pretends to be a support chat or similar feature, then asks for access to your photo gallery;

• Scans your photos for sensitive text like crypto seed phrases;

• Sends those photos (and device info) straight to the attackers’ command server.

Basically, if you’ve ever taken a screenshot of your crypto wallet recovery phrase… you’d be cooked.

And yeah, we’ve talked about stuff like this many times before. But until people stop getting scammed, we’re not shutting up.

So, here’s how to protect yourself:

1/ Only download from official app stores

Stick to Google Play and the Apple App Store.

And even then, don’t let your guard down – always check reviews and verify the developer.

2/ Don’t keep sensitive info in your photo gallery

No screenshots of seed phrases. No private keys. No “temporary” backups.

3/ Deny gallery access unless it makes sense

If an app that has nothing to do with photos asks for gallery access – say no.

But above all:

If your phone is where you manage your crypto, then it’s your wallet.

And just like you wouldn’t let a random stranger near your actual wallet, you shouldn’t let some sketchy app do that either.

As long as Bitcoin exists, it is independent – ​​the ability to trade and hold your own wealth without the need for third-party intermediaries like banks and other financial institutions, was central to the offer.

For some, self-custody is a firmly held belief in the right to “be your own bank.” For others, it is a practical step taken to protect valuable assets that can be possible and lost to exchange hacks, mismanagement, or FTX style collapse. If you have a run at a “bank”, it’s a bit like maintaining safe cash at home. Coins are immune to them.

And while the “ways” of self-custody have changed shape throughout Bitcoin history, today’s de facto industry standard (seed phrases) for recovery becomes a (sometimes a huge) loss when things go wrong.

Distinguishable distinction

In the early days of Bitcoin, there was only self-custody. At the risk of going too far, self-management means managing your secret key materials. This is a string of 64 random characters that gave people access to the underlying Bitcoin. There were quite a few tools to manage private keys. Remember them or write them down and store them in a safe place. But let one character out of place and oh my, the keys don’t work. Even if you do everything right, there is still a very real possibility of theft, accident, or loss of disaster.

Seedphrases are intended to make private keys easier to manage. Instead of securing a long string of random characters, Bitcoin Improvement Proposal-39 (BIP-39) can essentially withstand a handful of simple words inherently withstand private keys. As long as you have the correct sequence of words, you will always get the same private key and have access to your funds.

It’s definitely easier to deal with some common words than a long series of characters, but the risk of loss due to human error, theft, or disaster is essentially the same in seed phrases, just like private keys. It’s a distinction that makes no difference for those who lose their backup while they really need it. When it’s gone, it’s gone and it won’t be regained.

Moves beyond the Stone Age Security of Space Age Assets

Somewhere along the way, the overall idea of ​​independence has become synonymous with the phrase of the seed in the minds of many people. However, self-management is not the goal. It’s ability. Seed phrases are far more responsible than abilities.

Certainly, using seed phrases allows you to play keys or move funds to another wallet easily, but anyone who sees it can do that easily. This is a nuclear option. Anyone with access to the entire payload will grant it. That’s why most people who use them are forced to rely on rather old-fashioned security measures to protect them. Fill them, use book ciphers, distribute copies, fill them, engrave them, and more heat-resistant alloys.

But the idea that high security in digital caches could be closer to filling coffee at the perimeter of your backyard is absurd. It is Stone Age security of space age assets. And the idea that most people’s only recovery tool is something they themselves can lose fairly easily, if you can easily lose it, is it even a recovery tool at all?

Managing seed phrases may be better than dealing with secret key materials, but that’s not good yet. Not for security or security, not for the user experience, and ultimately not for the growth and widespread adoption of Bitcoin.

The future of money should work like the future of money

Bitcoin itself is intended to start as e-cash. Ultimately it is software and is intended to be run for use. For too many people, ensuring it is a source of great anxiety and practical difficulties. There is a better way.

The future of money should work on your preference, and ultimately secured, like the future of money, rather than the past. It opens up new abilities, inspires confidence, is intuitive and even fun to use. And you won’t lose access to coins just because you make typos or lose paper.

Even hardcore, even self-sovereign bitcoiners admit: seed phrases are pain. They were clunky stopgaps and were not intended to be the final game of the overt digital currency. We should stop treating them as they are the crucial features of self-custody.

This is a guest post by Max Guise. The opinions expressed are entirely unique and do not necessarily reflect the opinions of BTC Inc or Bitcoin Magazine.

Crypto Journalist

Amin Ayan

Crypto Journalist

Amin Ayan

About Author

Amin Ayan is a crypto journalist with over four years of experience in the industry. He has contributed to leading publications such as Cryptonews, Investing.com, 99Bitcoins, and 24/7 Wall St. He has…

Share

Last updated: 

June 7, 2025

A wave of violent kidnappings targeting cryptocurrency holders is pushing some of the industry’s most well-known figures to overhaul their security — including Didi Taihuttu, patriarch of the so-called “Bitcoin Family.”

Taihuttu, who famously sold everything in 2017 to go all-in on Bitcoin, revealed that his family has abandoned hardware wallets and now hides their crypto seed phrases across four continents.

The shift follows a string of threats and rising attacks on crypto holders worldwide.

Even at Gunpoint Attackers Would Get Little

“We have changed everything,” Taihuttu told CNBC from Thailand. “Even if someone held me at gunpoint, I can’t give them more than what’s on my phone wallet — and that’s not much.”

Over the past eight months, the family moved to a hybrid system: seed phrases are encrypted, split, and stored in both physical and digital formats.

Some parts are etched onto fireproof steel plates hidden across four continents. Others are stored via blockchain-based encryption services.

“You only need to remember which words you changed,” Taihuttu explained. The system ensures that even if attackers access part of the seed phrase, they cannot unlock the family’s full holdings.

The decision comes as physical attacks on crypto holders increase. Moroccan police this week arrested a suspect accused of kidnapping crypto executives.

In France, the father of a crypto millionaire was brutally attacked. And in New York, a tourist was tortured for over two weeks as kidnappers tried to extract his Bitcoin credentials.

The Taihuttus, who remain entirely unbanked and travel full-time with their three daughters, say they are rethinking even their public presence.

After strangers tracked their residence through YouTube videos, they stopped posting travel updates and moved homes.

“We got a little bit famous in a niche market — but that niche is becoming a big market now,” Taihuttu said, noting the family has decided to avoid traveling to France altogether.

About 65% of their crypto is now locked in cold storage across four continents. The rest remains in multi-signature wallets or decentralized exchanges for trading and daily spending.

Taihuttu said they avoid centralized vaults and services, preferring to retain full control.

“What happens if one of those companies goes bankrupt? You’re putting your capital back in someone else’s hands,” he said.

Crypto Executives Hire Bodyguards

As reported, crypto executives are turning to personal security services as targeted kidnappings and ransom attempts continue to escalate, particularly in France.

In May, private security firms such as Infinite Risks International, based in Amsterdam, reported a sharp increase in demand from crypto professionals seeking round-the-clock protection amid rising crypto kidnapping.

The rise in inquiries came a after spate of violent attacks, including multiple kidnappings attempts that have alarmed both investors and law enforcement.

May 2nd, 2025 – Auckland, New Zealand

Web3 infrastructure project backed by Waterdrip Capital and Royal Front aims to transform global AI computing with decentralized edge resource integration and scalable tokenized computing.

aZen, the decentralized AI-native computing infrastructure for Web3, announced it has raised $1.2 million in seed funding led by Waterdrip Capital, alongside participation from DWF Ventures, Rootz Labs, Mindfulness Capital, Attention Ventures, Quantum Leap Lab, DePIN-X, and ODIG.

In addition, aZen’s holding company has secured a $40 million equity investment from UAE-based Royal Front LLC to drive long-term expansion and ecosystem development.

“We are excited to back aZen’s vision of decentralized computing for the AI era,” said Jademont, CEO of Waterdrip Capital. “The team’s approach to combining DePIN with AI optimization has the potential to reshape how data, compute, and economic incentives align on a global scale.”

aZen has also been awarded strategic Web3 grants from Peaq, ICP, and Swarm, strengthening cross-chain collaboration and unlocking new integrations for decentralized physical infrastructure (DePIN) networks, enhancing liquidity, and expanding AI application reach across ecosystems.

“This is a defining moment for aZen,” said Felix Xia, CEO of aZen. “With the support of world-class investors, strategic grants, and ecosystem partners, we are scaling a truly decentralized computing infrastructure that empowers the next era of AI-driven applications. Our goal is to unlock the full potential of Ubiquitous AI — making intelligent services accessible, efficient, and decentralized.”

 Rapid Traction and Ecosystem Growth

Since its soft launch, aZen has demonstrated extraordinary momentum:

• 600,000+ app downloads (aZen Hub)
• 360,000+ monthly active users (MAU)
• 80,000+ active nodes on DePIN Lite testnet

These achievements position aZen as one of the most rapidly growing players in the DePIN sector, delivering decentralized, intelligent compute for AI agents, dApps, and enterprise applications.

Product Suite and Technology

aZen’s ecosystem includes:

• ZenHive — Commercial-grade edge device providing scalable AI, data analytics, and customer acquisition services for businesses.
• SocialFI AI Agent — Curates and amplifies high-value user-generated content across Web3 social platforms.
• DeFAI — Integrates AI into DeFi, optimizing staking, credit scoring, and liquidity management with intelligent agents.

Core innovations include transforming computing, AI, and applications into dynamic fractional NFTs (dfNFTs), enabling tokenization, leasing, and execution; intelligent compute resource scheduling; and privacy-preserving data processing for AI models.

Market Vision

With the rise of decentralized AI, the demand for scalable, distributed computing has exploded — yet current infrastructures lack the interoperability, scalability, and economic incentives required to power AI at global scale.

aZen is addressing this gap by building a universal DePIN layer that connects underutilized edge devices, cloud resources, and AI workloads through smart contract automation, unlocking new economic value for businesses, developers, and everyday users.

Strategic partnerships with Zenlayer (Tier 1 IaaS, 300+ datacenters worldwide) and ecosystem collaborators such as ICP, Peaq, and Swarm further strengthen aZen’s ability to deliver cross-platform DePIN resource sharing and liquidity.

About aZen

aZen is the decentralized computing protocol for Ubiquitous AI. By transforming computing, AI, and applications into tokenized, on-demand services, aZen delivers a scalable, interoperable foundation for decentralized AI agents, dApps, and enterprise use cases.

Website: https://azenprotocol.io

Social Media: https://x.com/azen_protocol and https://www.linkedin.com/company/azenprotocol

Contact

COO
Alessandro Venè
aZen
admin@azenprotocol.io

Owners of Ledger hardware wallets have reported receiving fake physical letters designed to trick them into revealing their wallet seed phrases as part of a new wave of crypto scams.

On April 29, tech analyst Jacob Canfield posted a warning on X, sharing a scam letter that had arrived at his home.

Disguised as official correspondence from Ledger, the letter instructed him to perform a “critical security update” by scanning a QR code and entering his 24-word recovery phrase.

Ledger Scam Letter Mimics Official Mail With Logo and Reference Number

The professionally designed letter included Ledger’s logo, a return address, and a reference number to lend credibility.

It warned that failure to complete the “validation” could result in restricted access to the user’s funds—an intimidation tactic meant to spur action.

Ledger responded directly to Canfield’s post, confirming the letter was fraudulent and part of a phishing attempt.

“Ledger will never ask for your 24-word recovery phrase,” the company reiterated, advising users not to trust unsolicited messages or individuals claiming to be Ledger representatives.

Seed phrases, often 12 to 24 words long, are the most sensitive component of a crypto wallet. Anyone who gains access to them can take full control of a user’s assets.

Some community members suspect the scam stems from Ledger’s infamous 2020 data breach, when the personal information of over 270,000 customers—including names, emails, and home addresses—was leaked online.

That incident was followed by numerous phishing campaigns, including one in which tampered Ledger devices were mailed to victims to install malware.

The recent mail scam appears to be another tactic targeting those affected by the breach, showing how long the consequences of data leaks can linger in the crypto world.

Phishing Scam Targets Coinbase, Gemini Users

In March, several crypto users flagged sophisticated phishing scam emails, which targeted Coinbase and Gemini users with legit-looking fraudulent emails.

The mass email reportedly arrived in various user inboxes on Saturday. The scam mail pointed to a class action lawsuit against Coinbase for allegedly involving in unregistered securities, adding that the court has mandated users to convert their assets into self-custody wallets.

Further, the mail also stressed that the deadline to transfer user assets to a self-custodial wallet is April 1st, 2025.

As reported, in the first three months of 2025, the crypto ecosystem lost a whopping $1,635,933,800 across 39 incidents, according to the blockchain security platform Immunefi.

The report claimed, “Q1 2025 marks the worst quarter for hacks in the history of the crypto ecosystem.”

Most of that was the result of only two hacks of two centralized exchanges. Phemex suffered a $69.1 million loss in January, while Bybit lost $1.46 billion in February.

Subsequently, the total number of losses in the first quarter marks a 4.7x increase compared to Q1 2024. At that time, hackers and fraudsters stole $348,251,217.

Notably, experts assume that the infamous North Korean Lazarus Group is behind the two largest attacks. They stole $1.52 billion, which is 94% of total losses.

The post Crypto Scammers Go Old School: Ledger Users Hit with New Seed Phrase Mail Scam appeared first on Cryptonews.

Scammers are mailing physical letters to the owners of Ledger crypto hardware wallets asking them to validate their private seed phrases in a bid to access the wallets to clean them out.

In an April 29 X post, tech commentator Jacob Canfield shared a scam letter sent to his home via post that appeared to be from Ledger claiming he needed to immediately perform a “critical security update” on his device. 

The letter, which uses Ledger’s logo, business address, and a reference number to feign legitimacy, asks to scan a QR code and enter the wallet’s private recovery phrase under the guise of validating the device.

The letter threatens that “failure to complete this mandatory validation process may result in restricted access to your wallet and funds.”

A seed phrase, or recovery phrase, is a string of up to 24 words that unlocks access to a crypto wallet. A scammer with the phrase can access and control the associated wallet to transfer its holdings elsewhere.

Earlier this month, the X account of a crypto hardware wallet reseller said it had also received multiple reports of Ledger users receiving a similar letter.

In response to Canfield’s post, Ledger said the letter is a scam and cautioned its device users to stay vigilant against phishing attempts.

Related: Ledger wallet user reports 10 BTC loss — Community blames phishing

“Ledger will never call, DM [direct message], or ask for your 24-word recovery phrase. If someone does, it’s a scam,” it added.

“Please don’t engage with accounts claiming to be Ledger employees or anyone offering to help recover funds.”

Unclear whether connected to the Ledger’s data leak

Canfield suggested that scammers were sending letters to Ledger customers whose data was leaked nearly five years ago.

In July 2020, a hacker breached Ledger’s database and dumped the personal information of more than 270,000 of its customers online, which included names, phone numbers and home addresses

The following year, several Ledger users claimed to have been mailed fake Ledger devices that were tampered with and designed to install malware upon use, Bleeping Computer reported at the time.

Magazine: Your AI ‘digital twin’ can take meetings and comfort your loved ones

You cannot extract seed phrases from the Wallet.DAT file created by Bitcoin Core software.

This is because Bitcoin Core does not generate numeric seeds using seed phrases/recovery phrases.

More generally, wallets that use seed phrases do not store them in data files. Certainly not a way for anyone to extract them without knowing the wallet password.

The current version of Bitcoin Core in early 2025 can continue to read wallets created by older versions, including those in legacy format.

I’ve read other tools that allow you to read the wallet.dat file that contains one or more named Pywallet.