The email arrived in your inbox with details that feel too specific to be random. Your name. Maybe a password you actually recognize. A threat to send damning footage — or compromising images — to your employer, your family, your entire contact list unless you send Bitcoin within 24 to 48 hours. A crypto blackmail scam is terrifying by design. It is built to make you panic and pay before you think clearly. Here is the most important thing you need to hear right now: stop, breathe, and do not send anything. In the vast majority of cases, these threats are completely fake — mass-blasted spam targeting hundreds of thousands of people simultaneously.
I have spent 12 years in blockchain and security. I have watched people lose thousands of dollars to these scams not because they were gullible, but because the email was frightening and the clock was ticking. This guide will help you understand exactly what is happening, how to figure out which type of threat you are dealing with, and what steps to take — starting right now.
How Crypto Blackmail Scams Work
Most crypto blackmail threats fall into two categories. Understanding which one you are facing changes everything about how you respond.
The Mass Sextortion Email
This is by far the most common type. Criminals purchase lists of email addresses and old leaked passwords from data breaches — the kind that come from hacked websites you may have used years ago. They then send millions of nearly identical emails claiming to have hacked your device, activated your webcam, and recorded you watching adult content. The email includes your email address and an old password as “proof.”
That password is not proof of anything except that a website you once used got hacked. It is not proof anyone has accessed your computer, your webcam, or your files. The scammer has never seen you. There is no video. The entire scheme is a bitcoin blackmail scam built on social engineering: manufacture enough fear and shame that a small percentage of recipients pay without questioning the claim.
According to the FBI’s Internet Crime Complaint Center (IC3), sextortion complaints have risen sharply over the past several years. In 2023 alone, the FBI received over 18,000 sextortion-related complaints with losses exceeding $13.5 million — and that number represents only the people who reported it.
Real Image Sextortion
This variant is less common but more serious. Here, the scammer genuinely has compromising images of you — obtained through a romance scam, a fake dating app, a catfishing scheme, or a hacked account. They use real material to make credible threats. The demands, the timeline, and the psychology are the same: pay in crypto or face exposure.
This type of sextortion crypto payment threat requires a different response — not because payment becomes a better idea (it never is), but because the remediation steps differ. More on that below.
How to Tell Which Type of Crypto Extortion Email You Received
Before you do anything else, ask yourself these three questions:
- Is the “proof” password one you actually use today? If the password in the email is old, one you have not used in years, or tied to a site that was publicly breached — this is almost certainly a mass sextortion email. The scammer scraped that password from a breach database and knows nothing else about you.
- Has the scammer sent you actual screenshots, video clips, or file names from your device? If the only “evidence” is an email with your address and an old password, no real access occurred. If they have sent genuine screen captures showing your actual files, open browser tabs, or real photos you recognize — this is more serious and likely in the second category.
- Is this a first-contact email from a stranger, or someone you have communicated with before? Mass sextortion arrives cold, from addresses you have never interacted with. If someone you matched with on a dating app, communicated with on social media, or met through a romance scheme is now threatening you, they may have images from those conversations.
Most people who find this article are dealing with the first type. But both are manageable. Neither requires you to pay.
If You Received a Mass Sextortion Email: Steps to Take Right Now
Work through these in order. The goal is to protect yourself, report the crime, and remove any leverage the scammer thinks they have.
- Do not pay. This is the single most important step. Paying proves two things to the criminal: that your email address is active, and that you are willing to send money under pressure. Payment does not end the threats — it starts a new negotiation. Every extortionist knows that someone who paid once can be pressured to pay again.
- Do not reply. Do not engage, do not ask for proof, do not try to negotiate. Any response tells the scammer your address is live and monitored.
- Check if your password was exposed in a breach. Go to haveibeenpwned.com and enter your email address. This free service will show you exactly which data breaches included your information. If the password in the extortion email matches a breach result — that is your answer. The scammer got it from a database dump, not from your device.
- Change the exposed password immediately. If you are still using that password anywhere, change it now. Use a unique, strong password for every account — a password manager makes this manageable. Enable two-factor authentication on any account that supports it.
- Report it to the FBI IC3. File a complaint at ic3.gov. This takes about 10 minutes and the data genuinely helps law enforcement track sextortion operations. The FBI has taken down several large-scale sextortion rings using IC3 complaint data.
- Report it to the FTC. File an additional report at reportfraud.ftc.gov. The FTC uses these reports to identify patterns and pursue enforcement actions.
- Block the sender and mark it as spam. This will not stop a determined criminal, but it keeps your inbox cleaner and signals to your email provider that messages from this source are junk.
After completing these steps, you have done everything you can do. The scammer has nothing on you. In most cases, you will never hear from them again — the economics of mass sextortion require low overhead and fast payouts, and someone who does not respond within 48 hours is quickly abandoned for the next batch.
Crypto Blackmail Scam With Real Images: Additional Steps
If you have reason to believe the scammer genuinely has compromising images of you — from a romance scam, a dating app, or a hacked account — the steps above still apply, but you need to add several more.
- Contact the FBI IC3 immediately and specify that real images are involved. The FBI has specialists dedicated to sextortion cases involving genuine material. When you file at ic3.gov, flag that actual images are at risk. You can also call your local FBI field office directly.
- If you are a minor or the images involve anyone under 18, contact NCMEC immediately. The National Center for Missing and Exploited Children (missingkids.org) operates a CyberTipline specifically for these situations and can escalate to law enforcement with additional resources. Their hotline is 1-800-843-5678.
- Document everything before blocking. Screenshot the threatening messages, the scammer’s profile, any account names or wallet addresses they have provided. This evidence matters for law enforcement. Then block the accounts.
- Contact a cybercrime attorney if images have already been distributed. If content has been posted publicly, an attorney who specializes in cyber harassment and image-based abuse can pursue takedown notices under applicable laws. Many states now have specific criminal statutes covering non-consensual image sharing.
- Reach out to the platform directly. If the threat originated on a social media platform or dating app, report the scammer’s account using the platform’s reporting tools. Major platforms have policies against image-based abuse and will act on credible reports.
The same fundamental rule applies here: do not pay. Research consistently shows that paying escalates rather than resolves these situations. Scammers who receive payment understand they have found a willing target and increase their demands. The FBI’s guidance is unequivocal: non-payment, combined with reporting, is the correct path.
The Honest Reality About Paying a Crypto Blackmail Scam
Every person who considers paying is thinking the same thing: maybe this one time, paying will make it stop. That logic feels rational in the moment of panic. But the data says otherwise.
Sextortion scammers are not one-time opportunists. They run industrial-scale operations targeting thousands of people simultaneously. Someone who pays is immediately flagged as high-value — a real email address, a real person willing to send money, a real target for the next round of demands. The FBI has documented cases where victims who paid were re-targeted weeks later with higher demands and new “evidence” claims.
Crypto makes these payments attractive to scammers specifically because transactions are irreversible. Once you send Bitcoin to a wallet address, there is no chargeback, no dispute process, no way to recover the funds. Your bank cannot help you. The exchange cannot reverse it. The money is gone, and the threats continue.
The scammer’s leverage depends entirely on your fear and your willingness to act before thinking. Remove the fear — by understanding what is actually happening — and the leverage disappears.
One Clear Takeaway
If you received a threatening email demanding crypto, the most important thing you can do is not act out of panic. Verify the claim (haveibeenpwned.com takes two minutes), change any exposed passwords, and report the crime to the FBI and FTC. Do not pay. Do not reply. These operations work because a small percentage of recipients pay quickly — and your job is simply not to be in that percentage.
You are not alone in receiving this. Millions of people get these emails every year. The vast majority who ignore them never hear from the scammer again.
Receiving crypto blackmail threats? Don’t pay — report it. The FBI has a dedicated team for this. File your report at ic3.gov — it takes 10 minutes and genuinely helps law enforcement track these operations.