<p>Giving away your public address wouldn't be the same as giving away your credit card. But what I think the sender of this email is might be trying to do is the following:</p>

<ol>
<li>Collect BTC loaded public addresses.</li>
<li><a href="https://bitcoin.stackexchange.com/a/3170/12809">Run (with brute force) common phrases, or even with common words to crack it</a></li>
<li>Collect any BTC with addresses which have weak private keys.</li>
</ol>

<p>If I would have done this, I would have used <a href="https://github.com/samr7/vanitygen" rel="nofollow noreferrer">vanitygen</a> to verify the common passwords (private keys), against the public addresses. Given that you can check 60k-300k private keys per second (with an i5 core), it'll be fairly easy to check all of the submitted addresses.</p>

<p>-Besir</p>

CC BY-SA 3.0
2014-01-30T20:23:40.097Z
Even simpler, the scam is simply asking for the original seed used to generate a deterministic private key. No brute force needed, they'll simply steal your money if you give them what they ask for.
Greg Hewgill
CC BY-SA 3.0
2014-01-30T20:02:38.093Z
2014-01-30T20:02:38.093Z
2017-04-13T12:47:33.283Z
Besir Kurtulmus
<p>A bitcoin <a href="https://en.bitcoin.it/wiki/Address" rel="nofollow noreferrer">address</a> is not like a credit card number. You can safely give your bitcoin address out publicly.</p>

<p>What the email is asking for is something you should <strong>never</strong> give out publicly: the mnemonic that you use (e.g. if you use <a href="https://electrum.org/seed.html" rel="nofollow noreferrer">Electrum</a>, they have a 12-word mnemonic code), from which you can calculate your private keys. With this, they can easily steal all bitcoins on any address that was generated using that mnemonic.</p>

<p>If they actually wanted to know that you are the owner of an address, they could ask you to <a href="https://bitcoin.stackexchange.com/q/3337/12034">sign a message</a>. There's not normally much of a reason to do this, though: I don't see a scenario in which a signed message is needed in order to give you money, instead of just the address.</p>

<p>If they actually just wanted to send you money (as they claim), all they need is your address.</p>

CC BY-SA 3.0
2014-01-30T20:55:53.820Z
A legit reason for verifying the adress first is to prevent sending 50 BTC into nirvana, when you don't have the private key for the adress anymore.
ZeissS
CC BY-SA 3.0
2014-01-30T20:03:24.877Z
2014-01-30T20:09:40.183Z
2017-04-13T12:47:33.660Z
Tim S.
<p>Today, I recieved this scam email:</p>

<blockquote>
  <p>We have reached the biggest milestone in our history – over a million wallets.</p>
  
  <p>https://[removed] will celebrate with some big prizes.</p>
  
  <p>In October 2013, the lucky user who created the 500,000th wallet was rewarded with 10 BTC.</p>
  
  <p>Read more about this: http://[removed]</p>
  
  <p>We have discovered that you created the wallet with number 1.000.000</p>
  
  <p>[removed] want to reward you with 50 BTC.</p>
  
  <p>To prove that you are the rightful owner of the lucky wallet,
     please reply to this email and send us your mnemonic ( the long string of words generated randomly when your account was created)</p>
  
  <p>After verification, your wallet will be credited instantly with the 50 BTC.</p>
  
  <p>Thank you that you have chosen https://[removed]</p>
</blockquote>

<p>I am guessing this is a scam as (a) it was sent to two separate email addresses I have, (b) the sender's email is in no way affiliated to the websites listed in the email and (c) I don't think anyone is willing to just give away 50 BTC which is close to $42,000 USD. I was wondering if I were to give them my Bitcoin address, what would happen next? Would they be able to use it like a credit card number? Or would they just be asking for more personal information?</p>

<client><address><fraud><phishing>
Should you protect your Bitcoin address like your credit card number?
SameOldNick
# Should you protect your Bitcoin address like your credit card number?

(Asked by: username_0 on 2014-01-30)

Today, I recieved this scam email:

> We have reached the biggest milestone in our history – over a million wallets.
>
> https://[removed] will celebrate with some big prizes.
>
> In October 2013, the lucky user who created the 500,000th wallet was rewarded with 10 BTC.
>
> Read more about this: http://[removed]
>
> We have discovered that you created the wallet with number 1.000.000
>
> [removed] want to reward you with 50 BTC.
>
> To prove that you are the rightful owner of the lucky wallet,
> please reply to this email and send us your mnemonic ( the long string of words generated randomly when your account was created)
>
> After verification, your wallet will be credited instantly with the 50 BTC.
>
> Thank you that you have chosen https://[removed]

I am guessing this is a scam as (a) it was sent to two separate email addresses I have, (b) the sender's email is in no way affiliated to the websites listed in the email and (c) I don't think anyone is willing to just give away 50 BTC which is close to $42,000 USD. I was wondering if I were to give them my Bitcoin address, what would happen next? Would they be able to use it like a credit card number? Or would they just be asking for more personal information?

**Tags:** client, address, fraud, phishing


---

## 2 answers

### Answer by username_3 on 2014-01-30. Score: 12 | Accepted answer

A bitcoin [address](https://en.bitcoin.it/wiki/Address) is not like a credit card number. You can safely give your bitcoin address out publicly.

What the email is asking for is something you should **never** give out publicly: the mnemonic that you use (e.g. if you use [Electrum](https://electrum.org/seed.html), they have a 12-word mnemonic code), from which you can calculate your private keys. With this, they can easily steal all bitcoins on any address that was generated using that mnemonic.

If they actually wanted to know that you are the owner of an address, they could ask you to [sign a message](https://bitcoin.stackexchange.com/q/3337/12034). There's not normally much of a reason to do this, though: I don't see a scenario in which a signed message is needed in order to give you money, instead of just the address.

If they actually just wanted to send you money (as they claim), all they need is your address.

> **Comments:**
> **username_4**: A legit reason for verifying the adress first is to prevent sending 50 BTC into nirvana, when you don't have the private key for the adress anymore.  

---

### Answer by username_1 on 2014-01-30. Score: -1

Giving away your public address wouldn't be the same as giving away your credit card. But what I think the sender of this email is might be trying to do is the following:

1. Collect BTC loaded public addresses.
2. [Run (with brute force) common phrases, or even with common words to crack it](https://bitcoin.stackexchange.com/a/3170/12809)
3. Collect any BTC with addresses which have weak private keys.

If I would have done this, I would have used [vanitygen](https://github.com/samr7/vanitygen) to verify the common passwords (private keys), against the public addresses. Given that you can check 60k-300k private keys per second (with an i5 core), it'll be fairly easy to check all of the submitted addresses.

-Besir

> **Comments:**
> **username_2**: Even simpler, the scam is simply asking for the original seed used to generate a deterministic private key. No brute force needed, they'll simply steal your money if you give them what they ask for.  

---

