What can go wrong

Several kinds of risk, not just one

This lesson gathers what can go wrong, so you recognise it before it happens to you. The risks fall into four groups: deception, your own mistakes, problems at companies that would hold your funds, and market risk. One thing they share: the Bank of England notes that if your money is stolen or mishandled, no one is responsible for helping you get it back. A fraud can and should be reported to the police, but getting the money back is rare, and the funds are not guaranteed like bank deposits.

Fraud: what it looks like

FraudfraudDeception by which someone tricks you into giving them money, data or access, usually through false promises or impersonation.Example: A message promising guaranteed gains if you send money first is a classic sign of fraud. means someone tricks you into giving them money, data or access. Around crypto-assets, the patterns repeat:

• PhishingphishingA fraud where someone pretends to be a known company or service, through a message or a fake site, to steal your data or access.Example: An "urgent" email with a link to a site that looks like a real service and asks for your recovery phrase.: a message or a site that pretends to be a known service and rushes you to enter data or give access.
• Impersonation: someone who presents themselves as "support", "administrator" or "representative" and writes to you first, in private.
• Promises of guaranteed gains or of "doubling": "send an amount now and get double back".
• Gifts and "opportunities" limited in time, so you have no time to think.
• Requests for a private key or recovery phrase, under any pretext.
• "Recovery" of lost money: after you have lost money, people appear who promise to recover it for a fee, often a second fraud.
• A relationship cultivated online, in which someone convinces you over time to "invest" on a platform they control.

Lumos Studio also has a project dedicated to online fraud, Scam Alert (opens in a new tab). This site will later have a whole track on security and fraud.

Your own mistakes

Not every loss comes from a fraudster. Bitcoin.org notes that the most common vulnerability is user error: wallet files deleted, lost or stolen. Transactions are irreversible, so a wrongly typed address cannot be fixed with a phone call to the bank. And a lost key, as we saw in lesson 4, can mean funds that are inaccessible for ever.

Platforms that can fail

Many people do not keep the keys themselves but use a trading platformtrading platformAn online service through which people buy, sell or hold crypto-assets; usually the company running it keeps the keys.Example: If a platform that holds your funds runs into trouble, your access to them can be affected. that holds them on their behalf (third-party custodycustodyWho keeps the keys to an asset: you (self-custody) or a company on your behalf (third-party custody).Example: Whoever has the keys has control; that is why it matters where they are kept.). It is convenient, but it means you depend on that company: if it runs into trouble, for example a cyber attack, poor management or bankruptcy, your access to the funds can be affected. We name no platforms and recommend none. Concrete stories about such events will come, as case studies, at Level 3.

Regulation: what it changes and what it does not

In the European Union there is a regulation for crypto-asset markets, MiCAMiCAThe European Union regulation on markets in crypto-assets: it sets uniform rules for issuers and service providers. It does not remove the risks.Example: A firm offering crypto-asset services in the EU has to follow MiCA rules, but the investment stays risky.. According to ESMA, it sets uniform rules for crypto-asset issuers and crypto-asset service providers (platforms, custody and so on), with requirements of transparency, disclosure, authorisation and supervision, and aims to ensure that buyers are better informed about the risks. It entered into force in June 2023 and has applied in full since December 2024; the transition period for firms already operating ended by 1 July 2026 at the latest.

The risk of total loss

The Bank of England says clearly that the value of a crypto-asset can fall to zero, making it worthless. All the risks above add up to one: the amount put in can be lost entirely. That is why, if you ever make a personal decision about crypto-assets, it has to be made knowing this, after reading official sources and not under the pressure of a message or a story. We do not tell you to do or not to do anything: we show you what to weigh.