DeFi Market
A sextortion email demanding bitcoin is almost always a mass-mailed bluff. The sender claims to have hacked your camera and recorded you, shows an old password or a photo of your house as "proof," and gives you 24 to 48 hours to pay. They have no video. The details come from data breaches and public maps, and the same email goes to huge numbers of people at once. Don't pay and don't reply. If the password is one you still use, change it everywhere. Then save the email, report it at ic3.gov and delete it.
Is the "I know your password" email real?
The email is real. The threat isn't. That's the short version, and every agency that has looked at these messages agrees on it.
The FTC's alert on bitcoin blackmail emails describes the standard script: the sender says they hacked your computer, recorded you visiting adult websites, and will send the video to your friends and family within hours unless you pay into a bitcoin address. The FTC's advice starts with three words: don't pay anything. Then delete the message, change any password it shows, and report it.
The Electronic Frontier Foundation reached the same conclusion when the scam first went big in 2018. It found the senders had likely matched a database of stolen emails and passwords and sent the message to potentially millions of people. When EFF checked five of the bitcoin wallets in those emails, only one had received any bitcoin at all. Most people who got it did the right thing and ignored it.
It hasn't gone away. The FBI's 2025 Internet Crime Report, released in April 2026, says its Internet Crime Complaint Center received more than 75,000 submissions about sextortion in 2025. That count covers every kind of sextortion, not only these bluff emails.
What the email says, line by line
The wording changes from wave to wave. The structure doesn't. Most versions hit the same beats, in roughly this order, and each one is there to push you toward paying before you think.
| What the email says | What's really going on |
|---|---|
| "I know your password is ..." followed by a real password | It came from an old data breach list. It proves your email was in a leak, not that anyone is in your computer |
| Your name, phone number and a photo of your house or street, often in a PDF | Names, addresses and numbers come from breaches and data brokers. The picture is usually from a mapping app |
| "I installed malware on your device" or names famous spyware | A claim with nothing behind it. No file, no proof, no detail only your device would show |
| "I recorded you through your webcam" | The core bluff. There is no video. If there were, they would attach a frame of it |
| "I will send it to all your contacts" | They don't have your contacts. The threat is generic so it fits everyone |
| "You have 24 to 48 hours" or "I'll know when you open this" | Pressure to act before you ask anyone. Opening an email doesn't start a countdown |
| "Pay this amount in bitcoin to this address," sometimes with a QR code | Bitcoin is used because it can't be reversed and doesn't need a bank. The address is copied into every email |
| The email appears to come from your own address | The "From" line was faked, which is called spoofing. Your account wasn't used |
| Signed by a hacker group, such as "ShinyHunters" | Borrowed names from the news. In May 2026 the FBI warned about extortion emails using the ShinyHunters name |
That last row comes from a May 2026 FBI public service announcement about extortion emails signed "ShinyHunters," the name of a real data-theft group. That alert covers extortion in general, not sextortion, but the scare tactic is the same. The FBI's advice in that alert matches everything else here: don't pay, and don't respond.
How did they get my password, phone number or a photo of my house?
This is the part that scares people most, so it helps to see how ordinary it is. Nobody studied you. A program did a lookup.
Your email address and an old password were almost certainly exposed in a breach at some site you used years ago. Those lists are sold and traded in bulk. The FTC notes the sender may really know one of your old or recent passwords, and that's exactly why they print it.
In 2024 the scam added a home photo. Krebs on Security reported readers getting emails addressed to them by name with a picture of their street or front yard, apparently pulled from a mapping app. 404 Media found the same emails carried full names, addresses and phone numbers, with the house photo inside an attached PDF. Some recipients got a photo of the wrong building. The New York State Police called it a nationwide automated campaign in September 2024, built on personal data bought illegally on the dark web, and said plainly that the scammer does not have access to the victim's device.
Can they really see me through my webcam?
No. Not in these emails. A real intruder with your camera would show you something only they could have: a frame, a file name, a detail from your screen. These emails never do, because the same text went to everyone on the list.
If the email still leaves you uneasy, a few ordinary steps will settle it. Install your system and browser updates. Run the security scan built into your computer. Check that your email account doesn't have a forwarding rule or a login from a place you don't recognize. A sliding camera cover costs a few dollars and ends the worry for good. None of this is because the email is true. It's just good upkeep, and it helps you stop thinking about it.
Should I pay?
No. Paying buys you nothing, because there is nothing to delete. It can also cost you more. EFF warns that paying may give the scammers a pressure point to keep coming back, and a payment tells them your address belongs to someone who scares easily.
Bitcoin is chosen for a reason. The FTC says that with crypto, you can usually only get your money back if the person you paid decides to send it back. That won't happen here. Some versions push people to a bitcoin ATM to pay quickly. If you're standing at one because of an email, stop and walk away.
Rob's take
I spent 18 years in PR, writing messages designed to get people to act. This email is a cheap version of that craft: a deadline, a threat and a dose of shame, so you move before you think. The counter is boring and it works. Wait. Close the email, make a cup of coffee and come back in an hour. The deadline will pass and nothing will happen, because nothing was ever going to happen.
What to do in the next 10 minutes
- Don't reply, click or scan anything. No links, no attachments beyond what you've already seen, no QR codes. A reply confirms a real person reads that inbox.
- Check the password. If it's one you still use anywhere, change it now on every account that shares it, starting with your email. You can see which breaches included your address at Have I Been Pwned, a free breach lookup.
- Turn on two-step login for your email and any crypto or bank account. An old password is useless to anyone once a code is also needed.
- Save the evidence. Keep the email, the bitcoin address and any PDF. A screenshot is fine. If you can, save the full email headers too (most mail apps call it "show original").
- Report it at ic3.gov, the FBI's complaint site, even if you didn't lose money. You can also report it to the FTC at ReportFraud.ftc.gov. Our guide on how to report a crypto scam walks through the forms.
- Mark it as spam, then delete it. That trains your filter for the next wave, and there will be one.
Not sure if a different message is the same kind of trick? Our Is this a scam? quiz takes about a minute. Crypto holders also get fake exchange alerts built on the same leaked data; our guide to fake Coinbase emails and texts shows how those look.
Prefer to watch? Why the sextortion email is a bluff, in under a minute.
Read the video transcript
Got a sextortion email demanding bitcoin? Breathe. It's a bluff. The sender says they hacked your webcam, recorded you, and will send the video to your contacts unless you pay within forty-eight hours. To scare you, they show an old password, or even a photo of your house. That password came from an old data breach. The photo came from a map app. The same email went to huge numbers of people at once. When the EFF checked five of these bitcoin wallets, only one had received any money at all. Here's what to do. One: don't reply and don't pay. Two: if you still use that password anywhere, change it and turn on two-step login. Three: save the email and the bitcoin address. Four: report it at ic3.gov, then delete it. What did the subject line of yours say? Comment below, and hit like and subscribe.
What if I already paid?
You're not the first, and it's worth acting quickly. Embarrassment is what these senders count on to keep people quiet, so the most useful thing you can do is tell the right people.
- Stop paying. If a second demand arrives, that's the scam working as designed. Don't answer it.
- Report it at ic3.gov with the bitcoin address, the amount, the date and time, and the transaction ID if you have it. Reports are how investigators connect one wallet to thousands of victims.
- Contact the exchange or ATM operator you used right away and tell them the payment went to a scammer. Recovery is rare, but the address can be flagged. Our guide on whether crypto scams can be traced explains what happens to the money next.
- Ignore anyone offering to get it back for a fee. Paid "recovery" offers aimed at scam victims are a second scam. Read how crypto recovery scams work first.
⚠ Red flag
Be wary of any follow-up message, from the same sender or from someone posing as a security company or investigator, offering to "remove the video" or "trace the hacker" for a fee. There is no video and no fee that fixes this. Real police don't charge you to investigate.
When it isn't a bluff email
This guide covers the mass emails sent to adults. A different crime happens when a real person, often someone met online, actually has private images and threatens to share them. That isn't a bluff, and it deserves real help: report it to the FBI at ic3.gov or your local field office, and don't pay.
If the person being threatened is under 18, contact the FBI and the National Center for Missing & Exploited Children's CyberTipline, or call 1-800-THE-LOST. The FBI's 2025 report says IC3 referred more than 5,700 submissions involving minors to NCMEC that year.
For the wider picture of scams aimed at crypto holders, start at our Scams hub.
Want the warning signs on one page? Get our free Scam Texts and Emails one-page check when you join the Sunday Briefing.
Bitcoin sextortion email FAQ
Is the "I know your password" email real?
The email is real, but the threat is a bluff. The password usually comes from an old data breach, and the same message goes out to huge numbers of people. The New York State Police say the sender does not have access to the victim's device.
Should I pay a sextortion email?
No. The FTC says don't pay anything, because there is no video to delete. Paying can also mark you as someone worth targeting again, and bitcoin payments almost never come back.
How did the scammer get my password or a photo of my house?
Passwords and email addresses come from data breach lists that are sold in bulk. Names, phone numbers and addresses come from breaches and data brokers, and the house photo is usually taken from a mapping app. Nobody had to look at your computer to get any of it.
Can they really see me through my webcam?
No. If they had footage they would show a piece of it, and they never do. Install your updates, run your computer's built-in security scan and cover the camera if it gives you peace of mind.
Where do I report a sextortion email?
Report it to the FBI at ic3.gov, even if you didn't lose money, and to the FTC at ReportFraud.ftc.gov if you like. Include the bitcoin address and keep a copy of the email. Then mark it as spam and delete it.
What if I already paid?
Stop paying and don't answer any new demands. Report it at ic3.gov with the bitcoin address, amount, date and transaction ID, and tell the exchange or ATM operator you used. Ignore anyone who offers to recover the money for a fee, because that is a second scam.