BTC Flash Scam

How Attackers Make Balances “Appear” (Show and Steal Scam / Fake Confirmation Scam)

• Fake screenshots / UI overlays: An altered image or a browser DOM overlay displays a deposit in the victim’s account  (BTC flash scam)
• Unconfirmed / mempool tx: Attacker provides a txid with 0 confirmations (mempool only). Scammers urge victims to move before confirmations finalize  a classic unconfirmed tx scam.
• Replace-by-fee / double-spending tricks: Attacker broadcasts an apparent incoming tx and then replaces it with a conflicting transaction or it is orphaned, removing the incoming funds.  (fake confirmation scam)
• Cloned explorers: Links to counterfeit block explorers that display false confirmations. (show and steal ploy)

The Scam Sequence (Simplified)

1. The method consists of the attacker displaying an “incoming balance” using a screenshot, fake transaction id, or a cloned interface. (Bitcoin Flash Scam)
2. The victim is then convinced to send funds, pay a “release fee,” or finalize a trade.  
3. The attacker waits until the victim sends funds, at which point they either cancel / invalidate the incoming transaction, or they just disappear.  
4. The victim no longer has the funds that they sent, and the “Incoming” balance never existed. (BTC Flash Scam / unconfirmed transaction scam)

Why Exchanges/Platforms are Targeted?

• User Impatience Exploited
  • Scammers capitalize on users who expect instant transactions, pushing them into hasty decisions that bypass proper verification.

• Off-Chain Balance Confusion
  • Because some platforms credit balances before on-chain confirmation, scammers exploit this gap to make fake deposits appear legitimate.

• Fake Confirmation Misuse
  • Attackers use the mismatch between displayed balances and actual blockchain confirmations to create convincing “flash” scams that trick users into releasing funds.