Claims, evidence and open questions

Bitcoin attracts strong claims, for and against. This page takes the most common myths one at a time, then looks at the ways Bitcoin and its users are attacked, and asks why. Judge each claim on its evidence.

Common myths

Pick a claim to see the short answer, the evidence, and what the critics get right.

ClaimBitcoin is mainly used by criminals.

Short answerNo. Illicit use is a small share, and Bitcoin’s public record makes crime easier to trace than cash.

The evidence

  • Chainalysis estimates illicit activity is below 1% of the crypto transaction volume it can attribute, and 84% of that illicit share now uses stablecoins (dollar tokens) rather than bitcoin.
  • A long-standing UN estimate puts money laundering at $800 billion to $2 trillion every year, overwhelmingly through cash and banks.
  • Every bitcoin payment stays on a public ledger forever. US investigators used it to recover most of the Colonial Pipeline ransom in 2021, and about 94,000 of the roughly 120,000 BTC stolen from Bitfinex in 2016, seized in 2022.

What critics get right

Criminals do use bitcoin, especially for ransomware and scams, and a stolen payment cannot be reversed.

Think about it

If criminals wanted to hide, why would they choose a ledger that records every payment forever?

Dollars versus crypto: illicit money per year

MoneyAmountWhat it measures
Traditional finance (mostly dollars, cash and banks)$800 billion – $2 trillion a yearUN estimate of money laundered worldwide: 2–5% of world GDP
All crypto, 2025At least $154 billionReceived by addresses linked to crime or sanctioned states; below 1% of all crypto volume
…of which stablecoins (dollar tokens)About $129 billion (84%)Digital dollars such as USDT and USDC
…of which bitcoin and all other coinsAt most about $25 billion (16%)Chainalysis does not publish bitcoin’s share alone, so this is an upper limit

The two estimates measure slightly different things, so compare their size, not exact figures. Even at the top of the crypto range, criminal crypto is a fraction of what moves through banks, and most of it is in dollars.

Sources: UNODC: money-laundering overview · Chainalysis: 2026 Crypto Crime Report

Major bank money-laundering cases

BankWhat happenedPenalty
TD Bank (2024)Pleaded guilty to money-laundering conspiracy, the first US bank ever to do so. Its failures let three laundering networks move more than $670 million, including drug money.More than $3 billion
Danske Bank (2022)Pleaded guilty to fraud. Its Estonian branch moved $160 billion through US banks for high-risk non-resident customers.About $2 billion forfeited
HSBC (2012)Admitted that at least $881 million of drug-trafficking money, including from the Sinaloa cartel, flowed through it.$1.9 billion
Wachovia (2010)Failed to check roughly $378 billion from Mexican currency exchanges; at least $110 million was drug money.$160 million
Binance, a crypto exchange (2023)Pleaded guilty to anti-money-laundering and sanctions failures. Crypto has its own major case too.$4.3 billion

Penalties are what the institutions paid, not the full amounts laundered. Reports on Wachovia range from $373 billion to $420 billion.

Sources: US DOJ: TD Bank · US DOJ: Danske Bank · US DOJ: HSBC · NBC News: Wachovia · US DOJ: Binance

Source: Chainalysis: 2026 Crypto Crime Report

How Bitcoin gets attacked

Bitcoin’s rules have held since 2009, so most attacks go around them: at the people, tools, companies and public opinion surrounding it.

Attacks on you

The easiest target is not Bitcoin, but the person holding the keys.

  • Phishing and fake supportFake websites, emails and “support agents” that ask for your seed phrase.
  • Malware and address swappingPrograms that swap a copied address for the thief’s, or steal wallet files.
  • Fake wallet appsCopies of real apps in app stores, built to steal seed phrases.
  • SIM swapsTaking over your phone number to reset exchange and email accounts.
  • Data leaks and wrench attacksWhen a company leaks customers’ home addresses, holders can face phishing and physical threats.

Defence: Keep your seed phrase offline, check addresses on your signing device, and keep your holdings private.

Source: Bitcoin.org: securing your wallet

Supply-chain attacks

Instead of attacking you, attackers poison the tools you trust.

  • Poisoned software updatesIn December 2023, a malicious version of a code library used by many wallet websites drained about $600,000 within hours.
  • Tampered hardwareSecond-hand or intercepted devices, or ones arriving with a pre-filled seed phrase card.
  • Fake downloadsLook-alike download sites serving altered wallet software.

Defence: Buy hardware directly from the maker, download only from official sources, and verify release signatures where offered.

Source: The Hacker News: Ledger Connect Kit attack

Attacks on exchanges and custodians

Companies holding many people’s keys are the biggest prizes.

  • Mt. Gox (2014)The largest exchange of its time collapsed, with about 850,000 BTC missing (about 200,000 were later found).
  • Bitfinex (2016)About 120,000 BTC stolen; most was recovered by US authorities in 2022.
  • FTX (2022)Customer funds were secretly misused; the exchange collapsed and its founder was convicted of fraud.
  • Bybit (2025)About $1.5 billion in crypto (mostly ether) stolen, attributed by the FBI to North Korea.

Defence: Not your keys, not your coins. Keep on exchanges only what you could afford to lose.

Source: FBI: North Korea responsible for the Bybit theft

Attacks on the network

These target Bitcoin itself. They are possible in theory, and very expensive in practice.

  • 51% attackControlling most of the mining power to reverse your own recent payments. It cannot steal other people’s coins or change the rules, and would cost billions in machines and energy.
  • Eclipse attackSurrounding one node with fake peers so it sees a false picture of the network.
  • Spam and fee pressureFlooding the network with transactions to raise fees for everyone.

Defence: More independent nodes and miners make every one of these harder. See the Nodes and Mining lessons.

Source: Bitcoin whitepaper

Future and hyped threats

Some threats are real but distant; some are mostly fear.

  • Quantum computersA large enough quantum computer could in theory work out a private key from a visible public key. Estimates of the machine needed range from tens of thousands to around a million qubits, and have been falling; nothing that size exists yet. Coins whose public key is already visible (very early coins, reused addresses, Taproot outputs) would be most at risk.
  • “AI will crack it”AI cannot break Bitcoin’s cryptography. Keys and hashes are protected by mathematics, and no amount of cleverness shortens a search that large. AI does make scams more convincing: fake voices, videos and phishing at scale.

Defence: Bitcoin can add quantum-resistant output types; proposals such as BIP-360 (outputs that do not publish a public key while unspent) are already being discussed, and the hard part is coordination, not the maths. Meanwhile, use a fresh address for every payment: non-Taproot addresses keep the public key hidden until you spend.

Source: BIP-360: Pay-to-Merkle-Root (proposal)

Pressure and narrative campaigns

Not every attack is technical. Some aim to change Bitcoin’s rules, cut it off from banks, or shape what people believe about it.

  • “Change the code” (2022)A $5 million campaign, funded by a co-founder of a rival cryptocurrency company and run with Greenpeace USA, pushed Bitcoin to abandon proof of work.
  • Proof-of-work restrictions (2022)A European Parliament committee voted down a proposal that could have restricted proof-of-work crypto in the EU.
  • Cutting off bankingUS bank regulators sent dozens of letters asking banks to “pause, or not expand” crypto activity; they were released only after a lawsuit. Critics call this “Operation Choke Point 2.0”.
  • National bansChina banned exchanges in 2017 and mining in 2021.
  • “Bitcoin is dead”Hundreds of published obituaries since 2010.
  • “Paper bitcoin” (disputed)Some argue derivatives and IOUs that are not backed by real coins hold the price down. Evidence is mixed; treat this as an open question.

Defence: Judge each claim on its evidence, check who is making it, and look for what they leave out.

Source: Decrypt: FDIC releases crypto “pause letters”

Why does it keep getting attacked?

If Bitcoin were worthless, why would anyone spend money and effort attacking it? Is it really because it is worthless, or because some fear it will gradually be adopted by more and more people and become a dominant money and payment system?

Possible answers to weigh

  • It is valuableThieves and hackers do not target worthless things. Billions in thefts are themselves evidence that people value it.
  • It competes with existing moneyBanks, payment companies and central banks earn fees or exercise control through today’s system. A money they do not issue or control challenges that.
  • Some concerns are sincereSome critics honestly worry about crime, energy and ordinary people losing money.
  • Rivals have their own interestsSome campaigns come from competing projects that would gain if Bitcoin changed or lost ground.

Questions to ask yourself

  • Who loses if Bitcoin succeeds? Who gains?
  • For each attack above, who paid for it, and what did they want?
  • Which criticisms stay true no matter who makes them?

A critic’s motive does not decide whether their claim is true. A self-interested critic can be right, and a sincere one can be wrong. Weigh the motive, then check the evidence.

Write a one-sentence conclusion that includes both the benefit and its limit. Revisit the underlying lesson if you cannot explain the mechanism.