Bitcoin

Betterment, a traditional investing service, was breached by crypto hackers. Thousands of users received fake push notifications and emails, promoting the classic “crypto giveaway” scam. 
Users received the fake alerts from Betterment’s mobile app. Others received emails promoting the giveaway scam. The fake message promised to triple users’ cryptocurrencies. The “promo” was valid for three hours. 
<h3 id="span-style-font-weight-400-crypto-attackers-impersonate-betterment-span">Crypto attackers impersonate Betterment</h3> 
The email instructed users to deposit as little as $1 or up to $750,000 in Bitcoin or Ether. The mobile app notification said, “For example, if you send $10,000 in Bitcoin or Ethereum, we’ll send you right back $30,000 to your sending Bitcoin or Ethereum address.” 
The hackers added specific Bitcoin and Ether wallet addresses. At the time of writing, the <a href="https://www.cryptopolitan.com/bitcoin-price-prediction/">Bitcoin</a> wallet had <a href="https://www.blockchain.com/explorer/addresses/btc/bc1q57nepfl2smeeccg834knn3vyr04jyre8azt83w" rel="nofollow noopener" target="_blank">received</a> 0.14626084 BTC, or $13,290.75. The Ether wallet has a <a href="https://etherscan.io/address/0xea88A68AdC1630531B5Be4Cc5BdE1D1efAc0D281#analytics" rel="nofollow noopener" target="_blank">net flow</a> of $1,779.30. 
<figure id="attachment_893142" aria-describedby="caption-attachment-893142" style="width: 100%" class="wp-caption alignnone">
 <img decoding="async" class="wp-image-893142 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2026/01/G-Q-A_tWEAASuNw.jpeg" alt="Classic crypto giveaway scam hits Betterment users after major breach." width="1079" height="822" srcset="https://www.cryptopolitan.com/wp-content/uploads/2026/01/G-Q-A_tWEAASuNw.jpeg 1079w, https://www.cryptopolitan.com/wp-content/uploads/2026/01/G-Q-A_tWEAASuNw-300x229.jpeg 300w, https://www.cryptopolitan.com/wp-content/uploads/2026/01/G-Q-A_tWEAASuNw-768x585.jpeg 768w" sizes="(max-width: 1079px) 100vw, 1079px">
 <figcaption id="caption-attachment-893142" class="wp-caption-text">
 A screenshot of the fake mobile app notification. Source: <a href="https://x.com/jareds3737/status/2009799522927735062?s=20" rel="nofollow">X</a>.
 </figcaption>
</figure> 
Two hours after the breach, the Betterment team issued a warning on X and Reddit.&nbsp;On Reddit, a Betterment representative replied to a thread about the hack,&nbsp;<a href="https://www.reddit.com/r/betterment/comments/1q8n1r2/comment/nyoxejd/?utm_source=share&amp;utm_medium=web3x&amp;utm_name=web3xcss&amp;utm_term=1&amp;utm_content=share_button" target="_blank" rel="noopener nofollow">saying,</a> “We apologize for the confusion. This is not a real offer from Betterment…” 
On X, Betterment’s official account explained that an unauthorized person gained access to its system. This allowed the attacker to send emails and push notifications on behalf of the company. 
The company <a href="https://x.com/Betterment/status/2010067788677984360?s=20" rel="nofollow">clarified</a>, “If you clicked on the offer notification, it did not compromise the security of your Betterment account.” Betterment reassured users, saying that “The unauthorized access has been removed,” and an investigation has been initiated. 
In a follow-up post, Betterment said the fake promo came from a third-party system. It <a href="https://x.com/Betterment/status/2009792566007673322?s=20" rel="nofollow">wrote</a>, “This was an unauthorized message sent via a third-party system we use for marketing and other customer communications.” 
Upon further inspection, the fake emails came from two inboxes belonging to e[dot]betterment[dot]com. This appears to be a subdomain of Betterment’s main website. 
A Redditor <a href="https://www.reddit.com/r/betterment/comments/1q8n1r2/comment/nyoqlfk/?utm_source=share&amp;utm_medium=web3x&amp;utm_name=web3xcss&amp;utm_term=1&amp;utm_content=share_button" rel="nofollow noopener" target="_blank">said</a>, “I got an email about this. Everything appears to check out, headers look good, SPF, DKIM, and DMARC all passed.” This means the email was cryptographically authenticated. It was not a spoofed Gmail or a fake sender line. Betterment’s domain approved the fake email. 
It’s unclear if user data was leaked from Betterment’s database to the <a href="https://www.cryptopolitan.com/stolen-crypto-data-dark-web-for-105/">dark web</a>. Moreover, the compromised third-party tool is unidentified yet. 
The breach shows how crypto hackers no longer rely on fake websites or cold emails. Attackers now use trusted financial platforms as a means of delivery. Once a user sends crypto, the money is gone. No chargebacks, no reversals, no recovery. 
If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" target="_blank">Stay there with our newsletter</a>.

Betterment users hit by classic crypto giveaway scam

Table of Contents

Cryptopolitan_News

Other articles published on Jan 11, 2026

Wells Fargo Reportedly Uses Bitcoin for Loan Collateral

With Stage 3 Live at $0.00002448, APEMARS Quietly Becomes the best Crypto To Buy Now With Asymmet...

UAE joins global Bitcoin hashrate competition through government-backed miners

Sei Network Suffers $240K Loss in Flash Loan Attack: Here’s How It Happened

U.S. Supreme Court Delays Decision on Trump's Tariffs

BANANA Price Action Update: Key Support Holds as Traders Watch $7.8–$8 Zone

Join our free newsletter for daily crypto updates!