Every day, Bitcoin Who’s Who gets emails about scams, fraud and suspicious Bitcoin activity. But every once in a while, a scammer manages to create a moment of perfect irony: they send a Bitcoin extortion email directly to Bitcoin Who’s Who—complete with the wallet address they want us to investigate.

According to the message, the attacker had supposedly gained access to our files, accounts and camera.

The scammer then claimed to have recorded us through the camera and threatened to distribute the alleged recording unless we paid $1,400 in Bitcoin.

And then came the part that made us smile.

The scammer provided the Bitcoin address where we were supposed to send the money:

16pQ54sHsqQrUR2nYQsf2r7g93nwc37k2j

Seriously?

You sent a Bitcoin extortion email…

to Bitcoin Who’s Who…

…and included the Bitcoin address?

That’s a little like sending a threatening letter to a locksmith and signing it:

“P.S. Here’s where I keep the spare key.”

The scammer’s master plan

The email follows a familiar sextortion formula.

First, establish fear:

Your computer has been compromised.

Then establish credibility:

I have your files, accounts and camera.

Then introduce embarrassment:

I recorded you.

Then create urgency:

I’ll send it to everyone you know.

And finally:

Send Bitcoin to this address.

It’s a simple psychological formula designed to get the recipient thinking about the threat instead of thinking about the evidence.

But there’s one problem with that strategy.

Bitcoin leaves a trail.

The address is the interesting part

The scammer apparently wants the recipient to focus on the alleged video.

At Bitcoin Who’s Who, we’re naturally more interested in the part where the scammer says:

“Send Bitcoin here.”

That’s because the Bitcoin address is something that can be investigated.

The email address can be spoofed.

The malware claims may be fabricated.

The alleged video may not exist.

But the Bitcoin address?

That’s something we can actually examine.

And that’s the delicious irony of this particular email.

The scammer gave Bitcoin Who’s Who exactly the information we would want to investigate.

“I removed my malware to leave no traces.”

That’s another interesting claim.

The scammer says the malware has supposedly been removed and that no traces remain.

Perhaps.

But Bitcoin doesn’t work quite the same way.

Blockchain transactions are publicly recorded.

The sender may believe they’ve created an anonymous payment destination.

Instead, they’ve potentially created a permanent piece of evidence.

That doesn’t mean a Bitcoin address automatically identifies its owner. Attribution can require considerable additional evidence.

But the transaction history is there.

And that’s a much more interesting place to start than an anonymous threat claiming:

“I recorded you.”

And then the scammer gives customer-service advice

Perhaps the funniest part of the email comes near the end.

After threatening the recipient, the scammer helpfully recommends several places to purchase Bitcoin and then concludes with legitimate cybersecurity advice:

Change your passwords and install security updates.

We’re not going to argue with that advice.

It’s just somewhat unusual to receive cybersecurity recommendations from the person who is supposedly blackmailing you.

The wrong audience

The scammer apparently wanted a frightened Bitcoin user.

Instead, they found themselves communicating with a company whose business revolves around investigating Bitcoin addresses associated with scams, fraud and other suspicious activity.

It’s difficult to imagine a more appropriate wrong number.

They didn’t just send the ransom note to the wrong person.

They sent the ransom note to the people who check the ransom address.

Don’t panic. Investigate.

For anyone else receiving an email like this, the important lesson isn’t that every sextortion email is harmless.

It’s that panic is exactly what the scammer wants.

Don’t automatically believe the claims.

Don’t assume that technical language means the sender actually has access to your computer.

Don’t send Bitcoin simply because someone threatens you.

Preserve the email.

Save the Bitcoin address.

Report the extortion attempt.

And investigate the payment address.

Because sometimes the scammer’s biggest mistake isn’t making the threat.

It’s telling you exactly where to look.

Thanks for the Bitcoin address.

We’ll take it from here.