Criminal addresses received at least $154 billion in crypto in 2025, according to the blockchain analytics firm Chainalysis. The same firm puts illicit activity below 1% of all the crypto volume it can attribute. Both numbers are correct. Put side by side, they show how crypto myths survive: most start from a real fact, then get cut to fit a story.
This lesson sorts crypto myths from facts for 15 beliefs you may hear at dinner, or in your own head before a first purchase: that Bitcoin is anonymous, that crypto escapes tax, that a blockchain cannot be hacked, that quantum computers will break it next year. Some held a grain of truth, or held one a few years ago. Each belief is checked against primary sources, from the Bitcoin white paper and its code to regulators, the FBI and university researchers. Every heading gives the verdict; the evidence and its dates sit underneath.
It follows our lesson on public, private and consortium blockchains, which showed that a blockchain is not always an open ledger anyone can read. Here we deal with public networks such as Bitcoin and Ethereum. Facts are as of October 2026, and nothing below is investment or tax advice.
Crypto myths and facts at a glance: 15 verdicts
The table sums up each belief and where the evidence leaves it. The sections that follow give the sources.
| Belief | Verdict | Why, in one line |
|---|---|---|
| Bitcoin is anonymous | False | Every transaction is public, and addresses can be tied to people. |
| Crypto is mostly used by criminals | False | Chainalysis puts illicit activity below 1% of tracked volume in 2025. |
| The blockchain cannot be hacked, so crypto cannot be stolen | Partly true | Ledgers resist rewriting; exchanges and wallets lost over $3.4 billion in 2025. |
| Crypto is a scam or a Ponzi scheme | Partly true | US victims reported $11.4 billion of crypto losses in 2025; Bitcoin has no issuer paying returns. |
| Only tech people use crypto | False | About one American adult in five has invested in or used it. |
| You need to buy a whole bitcoin | False | One bitcoin splits into 100 million satoshis. |
| Bitcoin supply is capped at 21 million | True | The issuance schedule is written into the consensus code. |
| Lost coins can be recovered | Mostly false | A self-custody key has no reset; exchange accounts are another matter. |
| Stablecoins are risk-free | False | USDC slipped below one dollar in March 2023 over a bank failure. |
| Transactions are free and instant | False | A fee always exists, and Bitcoin aims for one block every ten minutes. |
| Bitcoin mining runs on fossil fuels | Partly true | Surveyed miners reported 52.4% sustainable power in 2025. |
| Quantum computers will break Bitcoin soon | False for now | No such machine exists, but migration work has started. |
| Crypto is unregulated | Mostly false | MiCA has applied in full in the EU since 30 December 2024. |
| Crypto is not taxed | False | The IRS treats digital assets as property. |
| Governments will ban crypto | Partly true | China did; the EU, the US and the UK chose rules instead. |
Bitcoin myths debunked: who uses crypto, and how safe it is
Bitcoin is pseudonymous, not anonymous
Bitcoin’s creator never promised anonymity. Section 10 of the Bitcoin white paper, published under the name Satoshi Nakamoto in 2008, describes a weaker kind of privacy: the public can see “that someone is sending an amount to someone else, but without information linking the transaction to anyone.” Privacy, in that design, rests on nobody knowing who owns each key.
The same section names the weak spot. “The risk is that if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner,” it reads. Nakamoto advised a new key pair for every transaction and conceded that some linking cannot be avoided when one payment combines several inputs.
In practice, the owner is often revealed at the front door. Platforms that swap dollars or euros for crypto check their customers’ identity under know-your-customer (KYC) rules, so the first address a buyer receives coins on is often tied to a passport. From there, analysts can follow the coins across a ledger that keeps every transaction for as long as the network runs. In the UK, authorities seized 61,000 bitcoin linked to an investment fraud run by Zhimin Qian, which Chainalysis says had more than 128,000 victims between 2014 and 2017.
One part of the belief is true: no name is written on the chain, and a user who never reuses addresses keeps a fair amount of privacy. Some coins were built to go further. Monero and Zcash hide parts of each transaction, and in October 2026 Coindaro reported that a bug on the privacy coin Pirate Chain had minted 39.8 million ARRR, which vanished into its shielded smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool, a reminder that the same tools can hide a theft as well as a salary. Policy keeps moving too: the US Treasury removed the mixing service Tornado Cash from its sanctions list on 21 March 2025, while saying it remained concerned about North Korean laundering.
Illicit activity is below 1% of tracked crypto volume, though the sums are huge
Criminals use crypto, and on a large scale. Chainalysis, a blockchain analytics firm, estimated in its 2026 Crypto Crime Report, published on 8 January 2026, that addresses linked to illicit activity received at least $154 billion in 2025, the figure quoted at the top of this lesson. That was 162% more than its revised figure of $57.2 billion for 2024, and the firm calls the total a lower-bound estimate.
Set against all the activity Chainalysis can attribute, the share is small. Chainalysis writes that its estimate of the illicit share “increased slightly from 2024 but remains below 1%.”
Most of the 2025 jump came from one source: sanctions. Entities under sanctions received $104 billion, up 694%, Chainalysis wrote on 5 March 2026. A7A5, a token pegged to the Russian rouble, moved $93.3 billion in about ten months of 2025. US and UK authorities designated entities linked to it in August 2025, and the EU banned transactions with it in October. Stablecoins carried 84% of all illicit transaction volume.
The criminal share is small, yet the absolute numbers are real, and they only cover what can be linked to known illicit addresses on-chain. “Below 1%” means below 1% of what analysts can trace, which is not the same as proof that crypto is clean. Governments are adding tools: on 14 October 2026, the EU and eight countries, the UK among them, signed a Council of Europe protocol on seizing criminal crypto across borders, which is not yet in force.
The ledger is hard to rewrite, but exchanges and wallets are hacked every year
Thieves took more than $3.4 billion in crypto between January and early December 2025, according to Chainalysis. The biggest losses hit companies and people, not ledgers. The largest single theft, about $1.5 billion from the exchange Bybit on 21 February 2025, was the work of North Korea, the FBI said five days later in a public service announcement. The Bureau listed the Ethereum addresses that the attackers, a group it calls TraderTraitor, were using to launder the funds, and asked exchanges, bridges and node operators to block transactions linked to them.
North Korean groups stole at least $2.02 billion in 2025, 51% more than in 2024, by Chainalysis’s count. Individuals are targets as well. Thefts from personal wallets came to $713 million across 158,000 incidents, with at least 80,000 victims. Some attacks are physical. Jameson Lopp’s public list of so-called wrench attacks, where holders are threatened or beaten into handing over keys, held 702 entries on 18 October 2026, about twice its size a week earlier after an AI-assisted search added older cases nobody had logged. France has the most entries dated 2026, as our count of Lopp’s list shows.
The software is not flawless either. In September 2018, Bitcoin Core developers fixed CVE-2018-17144, a bug that in versions 0.15 to 0.16.2 could have let a miner create bitcoin beyond the normal issuance. “We are unaware of any attempts to exploit this vulnerability,” the disclosure notice of 20 September 2018 said. Newer code and younger companies have had their own failures. In a postmortem published on 16 October 2026, the NEAR Intents team said a bug in its own contract had credited an attacker with about $3.8 million of funds that did not exist; it says the money was returned. The exchange Bitget lost about $388 million from its hot and warm wallets on 24 September 2026, according to its own incident page.
The myth is right about one thing: rewriting the history of a large public blockchain is very expensive, which is why attackers go after the software and the people around it. That points to a defence. Keys you hold yourself, backed up as our guide to keeping a seed phrase safe explains, take the exchange off the list of things that can fail, and put your own habits on it.
Scams are everywhere in crypto, but Bitcoin is not a Ponzi scheme
Americans reported $11.366 billion of crypto-related losses in 2025, according to the annual report of the FBI’s Internet Crime Complaint Center (IC3), released in April 2026. That is 22% more than in 2024 and more than half of the $20.877 billion in losses reported for all types of internet crime. The center logged 181,565 crypto complaints, with an average loss of $62,604.
Crypto investment fraud alone cost $7.228 billion, which the FBI calls “the highest source of financial losses to Americans in 2025.” Crypto ATMs and kiosks featured in 13,460 complaints, for $389 million. The Bureau says most of these schemes are run by organised crime groups based in Southeast Asia, which force trafficking victims to work the scams.
Chainalysis estimated on 13 January 2026 that scams took about $17 billion in 2025, with at least $14 billion visible on-chain. The average scam payment rose from $782 in 2024 to $2,764, and impersonation scams grew 1,400% in a year. High-yield investment programmes, which promise fixed returns, rank among the main types.
Why only partly true, then? A Ponzi scheme needs an operator who promises returns and pays them out of newer investors’ money. Bitcoin has no operator, no promised return and nobody paying out: its software issues new coins to miners on a fixed schedule, and a holder gains or loses only as the market price moves. Plenty of tokens and platforms do fit the scam pattern, so the test lies in the details, starting with who issues the asset and who promises what. Our guide on how to avoid crypto scams lists the warning signs. Regulators add their own: Italy’s market authority, Consob, warned in November 2024 that crypto is highly speculative and that investors can lose all their capital.
Crypto users are mostly ordinary people, not developers
About one American adult in five, 19%, has invested in or used cryptocurrency, according to a Pew Research Center survey of 8,512 adults carried out from 20 to 26 January 2026 and published on 8 June. The share was 16% in 2021. Among Republicans it reached 22%.
Pew’s February 2024 survey showed the other side of the picture: 63% of Americans were not confident that crypto is safe and reliable, and 38% of past users said it had done worse than they expected.
Europe shows the same orders of magnitude. A barometer by ADAN, the French crypto industry association, and Ipsos found in January 2026 that about 11% of French adults held crypto-assets, against 17% in Germany and 20% in the Netherlands. In Italy, Consob reported in November 2024 that the share of Italians holding crypto went from 8% to 18% between 2022 and 2023. In the UK, awareness of cryptoassets stood at 91% in the FCA’s 2025 consumer research, and 73% of owners used a centralised exchange.
Users remain a minority in every country these surveys covered, and the figures do not compare neatly, since “ever used” and “hold now” are different questions. None of them describes a club for programmers. Most owners in the FCA research used an exchange, not software they wrote or ran themselves.
How the money works: fractions, supply, lost keys, stablecoins and fees
You can buy a fraction of a bitcoin, down to one hundred-millionth
One bitcoin equals 100,000,000 satoshis, the smallest unit the network records. The number sits in Bitcoin Core’s consensus code, where a constant defines one coin as 100 million base units. Transactions are counted in satoshis, so a payment of 0.0005 BTC is as ordinary to the network as one of 5 BTC.
Exchanges let customers buy by amount in dollars or euros, each with its own minimum order; our guide on how to buy crypto goes through it step by step. Ether and most other coins divide into small units in the same way. The belief comes from headline prices, which quote one whole coin and make the entry ticket look bigger than it is.
One caveat: very small purchases can be eaten by fees, since a fixed charge weighs more on a $20 order than on a $2,000 one.
Is Bitcoin supply capped at 21 million? Yes, by a rule in the software
This belief is true. Bitcoin’s issuance follows rules in its code: the first blocks paid miners a subsidy of 50 BTC, the subsidy halves every 210,000 blocks, and the network aims for one block every ten minutes. Add up that halving series and you get just under 21 million coins. Bitcoin Core also carries a constant, MAX_MONEY, set at 21 million BTC, which its own comments describe as a sanity check rather than the total money supply.
At ten minutes a block, 210,000 blocks take about four years, hence the familiar four-year halving cycle. The code counts in satoshis and drops fractions at each halving, so the subsidy reaches zero at block 6,930,000, after 33 halvings. At the target pace that block arrives about 132 years after the first one in January 2009: the last new bitcoin should be mined around 2140. Our beginner’s guide to Bitcoin explains how miners and halvings fit together.
The doubters have a point on one detail. The cap is a rule that nodes enforce by running the software, not a law of physics, and changing it would take the people who run the network adopting new rules. It also applies to Bitcoin alone. Ethereum has no fixed maximum supply, and each token sets its own issuance, so a “limited supply” line in a project’s marketing means little until you read its rules. Part of the 21 million is also gone for good, which leads to the next belief.
Coins lost from a self-custody wallet stay lost
There is no “forgot my password” button in Bitcoin. Whoever holds the private key, usually backed up as a 12- or 24-word seed phrase, controls the coins. If the phrase is gone, no company, developer or court can issue a new one.
Coins do sometimes change hands again, through seizure rather than recovery. The 61,000 bitcoin in the UK case above were seized by the authorities in a fraud case, not handed back to someone who had lost a key.
The belief survives because of a real difference. If your coins sit on an exchange, the exchange holds the keys and can let you back into your account after an identity check, much as a bank would. That convenience is the price of handing over custody, and the reason many holders keep only part of their coins on a platform.
The gap also feeds a fraud. The FBI’s IC3 received 10,516 complaints about recovery scams in 2025, for $1.4 billion of losses, and noted that fictitious law firms approached people who had already lost money to scams. Anyone who asks for an upfront payment to recover crypto from a lost seed phrase, or from a scam, fits that pattern.
Lost coins may raise one more question in future. Google’s quantum researchers wrote in March 2026 that the crypto world should decide now what to do with abandoned coins whose keys could one day be exposed, a point covered under the quantum belief below.
Stablecoins are not risk-free: even USDC lost its peg in 2023
In March 2023, Circle, the issuer of USDC, had $3.3 billion of its reserves, about 8%, deposited at Silicon Valley Bank when the bank failed, and the token slipped below one dollar. Once US authorities had guaranteed the bank’s deposits, Circle said in a statement that the risk to its reserves had been removed and that the de-peg was closing. “As a regulated payment token, USDC remains redeemable 1:1 with the U.S. Dollar,” it added. A year earlier, in May 2022, the algorithmic stablecoin TerraUSD lost its peg and never regained it. Its founder, Do Kwon, was sentenced to 15 years in prison in New York in December 2025.
A stablecoin is a promise made by a company. A well-reserved coin that can be redeemed at face value moves far less than bitcoin, but its value still depends on the reserves behind it, on the issuer staying solvent, and on how quickly holders can get their dollars back. Issuers are businesses with interests of their own: Circle said on 16 October 2026 that about 59 cents of every dollar of revenue and reserve income in the first half of the year went to distribution partners and transaction costs.
Rules are tightening. MiCA sets reserve and licensing requirements for stablecoins offered in the EU, and ESMA has told licensed firms to stop services linked to non-compliant stablecoins, with 8 January 2027 as the outer limit for clearing client positions. Stability has a darker use too: stablecoins carried 84% of illicit crypto volume in 2025, according to Chainalysis. Our guide to how stablecoins work compares the different models.
Transactions always cost something, and speed depends on the chain
Bitcoin’s code targets one block every ten minutes, so a payment usually waits several minutes for its first confirmation, longer when blocks are full, and many services wait for several confirmations before crediting a deposit. Every payment also carries a fee for the miner who includes it. When we checked on 18 October 2026, the public mempool.space service recommended 1 satoshi per virtual byte at every priority level, or about 140 satoshis for a simple payment of 140 virtual bytes. Cheap, then, but not free, and fees climb when demand for block space does.
Ethereum runs on another clock. Its proof-of-stake system divides time into 12-second slots grouped in 32-slot epochs, according to ethereum.org. A block can land within seconds, but finality requires a supermajority of validators to confirm checkpoints, which takes about two epochs, roughly 13 minutes by our arithmetic. Other networks make other trade-offs. Solana has scheduled its Alpenglow upgrade for 21 October 2026 with a finality target of 150 milliseconds, a goal rather than a measured result.
Crypto payments do have a practical edge. Networks run every day of the year with no business hours, and on Bitcoin the network fee depends on the size of the transaction in bytes, not on the amount sent. Exchange fees, card fees and spreads come on top and are separate from the network fee.
Energy and quantum computing: two fears, two different answers
Bitcoin energy consumption is large, and miners report about half as sustainable
Bitcoin mining uses about 138 terawatt-hours of electricity a year, around 0.5% of global consumption, according to the Cambridge Digital Mining Industry Report published by the Cambridge Centre for Alternative Finance (CCAF) on 28 April 2025. The report put the network’s emissions at about 39.8 million tonnes of CO2 equivalent.
The energy use is deliberate. Proof of work makes miners spend computing power to propose blocks, and that cost is what makes rewriting the ledger so expensive for an attacker.
The “only fossil fuels” part does not survive the data. Miners surveyed by Cambridge reported that 52.4% of their electricity came from sustainable sources, 42.6% renewables and 9.8% nuclear, up from 37.6% in 2022. Natural gas became the largest single fossil source, at 38.2%, while coal dropped from 36.6% in 2022 to 8.9%. “This report directly addresses a persistent data gap by relying on direct practitioner insights rather than abstractions,” said Alexander Neumueller of the CCAF.
Still, 138 TWh is a lot of power, and the mix comes from 49 companies that chose to answer a survey: an estimate, not a meter reading. Cambridge’s live index, the CBECI, tracks the consumption figure over time. Ethereum no longer has miners at all, since it moved to proof of stake, so the energy argument today is about Bitcoin.
No quantum computer can break Bitcoin today, but the migration work has begun
On 30 March 2026, Google Quantum AI published a whitepaper estimating that Shor’s algorithm could break the elliptic-curve signatures used by Bitcoin and Ethereum with at most 1,200 logical qubits and 90 million Toffoli gates. On superconducting hardware with an error rate of one in a thousand, the attack could run “in minutes using fewer than half a million physical qubits,” the paper says. Its co-authors include Justin Drake of the Ethereum Foundation and Dan Boneh of Stanford.
Today’s machines are nowhere near that. Willow, the Google chip on which the company reported on 15 October 2026 a roughly 40-fold cut in errors for so-called magic states, has 105 qubits; our report on Google’s 40-fold error cut explains what the experiment changes for Bitcoin and what it does not. No machine able to break these signatures exists, and nobody can say with any confidence when one will.
The exposure is concrete, though. Glassnode counted on 20 May 2026 that 6.04 million BTC, about 30.2% of the supply then issued, sat at addresses whose public keys were already visible on-chain, the coins a quantum attacker would target first. Mining is less at risk: Shor’s algorithm does not break the SHA-256 hash function that proof of work uses, and the speed-up from Grover’s algorithm is modest.
Work has started. NIST approved its first three post-quantum cryptography standards, FIPS 203, 204 and 205, on 13 August 2024. Google’s paper urged every vulnerable cryptocurrency community to join the migration “without delay”. On Bitcoin, two proposals, BIP-360 and BIP-361, were still drafts with no activation date as of October 2026.
Law, tax and the state: the beliefs that aged fastest
Crypto is regulated in the EU, the US and the UK, with gaps
The European Union’s Markets in Crypto-Assets regulation, MiCA, entered into force in June 2023 and has applied in full since 30 December 2024. Firms already serving clients before that date could continue under national transition periods that ended on 1 July 2026 at the latest. ESMA, the EU markets authority, keeps an interim register of authorised crypto-asset service providers, white papers, stablecoin issuers and non-compliant entities, updated weekly. Our guide to the MiCA regulation sets out what licensed firms must do.
In the UK, the Financial Conduct Authority opened the authorisation gateway for its new cryptoasset regime on 30 September 2026, and it closes on 28 February 2027, according to the FCA’s gateway page. In the US, there is still no single crypto law for markets: the CLARITY Act is stalled in Congress while the SEC and CFTC write rules, and the SEC has proposed custody rules for investment advisers and funds that hold crypto.
Gaps remain, because these rules cover companies and their advertising, not code. A self-custody wallet, or a DeFi protocol with no company running its front end, needs no licence, and the legal status of a given token can still differ from one country to the next.
Crypto gains are taxed: in the US they are property, reported on Form 1099-DA
“For U.S. tax purposes, digital assets are considered property, not currency,” the IRS says. Property rules therefore apply, and selling crypto at a profit can produce a taxable gain. Brokers report gross proceeds on a new form, 1099-DA, for sales made on or after 1 January 2025, and from 2026 they also report cost basis for certain transactions. Form 1040 asks every filer to answer yes or no to a question on digital assets.
European countries tax crypto gains too, each with its own rates, thresholds and forms. MiCA, which has applied since 30 December 2024, is a market rule rather than a tax law, so rates are set country by country, and they change. On 16 October 2026, French MPs voted at first reading to tax swaps into stablecoins such as USDC from 2027, a measure that is not yet law, as our report on the French vote explains. UK readers should check HMRC’s current guidance on gov.uk, which this lesson has not reviewed.
In practice the paperwork usually falls on the holder, who needs a record of every purchase price to work out gains. This section is general information; the tax authority of your own country has the final word.
A few states banned crypto; most chose to regulate it
China went furthest. On 24 September 2021, the People’s Bank of China declared all crypto-related transactions illegal, the Associated Press reported, and its rules also treat offshore exchanges serving residents of mainland China as illegal financial activity. Russia is narrowing what its citizens may do: in an FAQ update dated 12 October 2026, the Bank of Russia said peer-to-peer crypto deals between individuals are allowed only until 1 July 2027, and that coins may not move from regulated accounts to self-custody wallets.
The wider trend runs the other way. The EU wrote MiCA, the UK is licensing crypto firms, and central banks are building their own digital money instead of banning private coins. In a statement to the IMF’s steering committee on 17 October 2026, ECB President Christine Lagarde wrote that the ECB “will run a 12-month internal pilot in the second half of 2027”, provided the EU’s digital euro law is adopted in time.
A public network that runs on computers in many countries is hard to switch off from one capital. What a government can do is make it costlier or riskier for its own residents, by closing exchanges, blocking payments or taxing every step.
How to check a crypto claim yourself
Every verdict above came from the same few habits, and they work on the next claim you meet as well.
Separate the protocol from the companies around it. A blockchain’s rules and an exchange’s security are different questions: most of the thefts, freezes and failures in this lesson happened at companies, apps or individuals, not in the ledger.
Check the date and the definition behind each figure. “Below 1%” and “$154 billion” describe the same Chainalysis data. “19% have used crypto” in the US and “11% hold it” in France answer different questions, in different years, in different countries.
Then go to the primary source: the white paper, the code, the regulator’s page, the court ruling, the agency’s report. If an article cannot point to one, treat its claim as unverified until you find it.
That last habit is the subject of the next lesson in this path, how to read crypto news, which applies these checks to headlines and to the posts that spread them.
