Bitcoin

Betterment, a traditional investing service, was breached by crypto hackers. Thousands of users received fake push notifications and emails, promoting the classic “crypto giveaway” scam.
Users received the fake alerts from Betterment’s mobile app. Others received emails promoting the giveaway scam. The fake message promised to triple users’ cryptocurrencies. The “promo” was valid for three hours.
<h3 id="span-style-font-weight-400-crypto-attackers-impersonate-betterment-span">Crypto attackers impersonate Betterment</h3>
The email instructed users to deposit as little as $1 or up to $750,000 in Bitcoin or Ether. The mobile app notification said, “For example, if you send $10,000 in Bitcoin or Ethereum, we’ll send you right back $30,000 to your sending Bitcoin or Ethereum address.”
The hackers added specific Bitcoin and Ether wallet addresses. At the time of writing, the <a href="https://www.cryptopolitan.com/bitcoin-price-prediction/" rel="noopener noreferrer nofollow">Bitcoin</a> wallet had <a href="https://www.blockchain.com/explorer/addresses/btc/bc1q57nepfl2smeeccg834knn3vyr04jyre8azt83w" rel="noopener noreferrer nofollow" target="_blank">received</a> 0.14626084 BTC, or $13,290.75. The Ether wallet has a <a href="https://etherscan.io/address/0xea88A68AdC1630531B5Be4Cc5BdE1D1efAc0D281#analytics" rel="noopener noreferrer nofollow" target="_blank">net flow</a> of $1,779.30.
<figure style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" src="https://www.cryptopolitan.com/wp-content/uploads/2026/01/G-Q-A_tWEAASuNw.jpeg" alt="Classic crypto giveaway scam hits Betterment users after major breach." width="1079" height="822">
 <figcaption>
 A screenshot of the fake mobile app notification. Source: <a href="https://x.com/jareds3737/status/2009799522927735062?s=20" rel="noopener noreferrer nofollow">X</a>.
 </figcaption>
</figure>
Two hours after the breach, the Betterment team issued a warning on X and Reddit.&nbsp;On Reddit, a Betterment representative replied to a thread about the hack,&nbsp;<a href="https://www.reddit.com/r/betterment/comments/1q8n1r2/comment/nyoxejd/?utm_source=share&amp;utm_medium=web3x&amp;utm_name=web3xcss&amp;utm_term=1&amp;utm_content=share_button" target="_blank" rel="noopener noreferrer nofollow">saying,</a> “We apologize for the confusion. This is not a real offer from Betterment…”
On X, Betterment’s official account explained that an unauthorized person gained access to its system. This allowed the attacker to send emails and push notifications on behalf of the company.
The company <a href="https://x.com/Betterment/status/2010067788677984360?s=20" rel="noopener noreferrer nofollow">clarified</a>, “If you clicked on the offer notification, it did not compromise the security of your Betterment account.” Betterment reassured users, saying that “The unauthorized access has been removed,” and an investigation has been initiated.
In a follow-up post, Betterment said the fake promo came from a third-party system. It <a href="https://x.com/Betterment/status/2009792566007673322?s=20" rel="noopener noreferrer nofollow">wrote</a>, “This was an unauthorized message sent via a third-party system we use for marketing and other customer communications.”
Upon further inspection, the fake emails came from two inboxes belonging to e[dot]betterment[dot]com. This appears to be a subdomain of Betterment’s main website.
A Redditor <a href="https://www.reddit.com/r/betterment/comments/1q8n1r2/comment/nyoqlfk/?utm_source=share&amp;utm_medium=web3x&amp;utm_name=web3xcss&amp;utm_term=1&amp;utm_content=share_button" rel="noopener noreferrer nofollow" target="_blank">said</a>, “I got an email about this. Everything appears to check out, headers look good, SPF, DKIM, and DMARC all passed.” This means the email was cryptographically authenticated. It was not a spoofed Gmail or a fake sender line. Betterment’s domain approved the fake email.
It’s unclear if user data was leaked from Betterment’s database to the <a href="https://www.cryptopolitan.com/stolen-crypto-data-dark-web-for-105/" rel="noopener noreferrer nofollow">dark web</a>. Moreover, the compromised third-party tool is unidentified yet.
The breach shows how crypto hackers no longer rely on fake websites or cold emails. Attackers now use trusted financial platforms as a means of delivery. Once a user sends crypto, the money is gone. No chargebacks, no reversals, no recovery.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" target="_blank" rel="noopener noreferrer nofollow">It's free</a>.

Betterment users hit by classic crypto giveaway scam

Table of Contents

Cryptopolitan_News

Other articles published on Jan 11, 2026

Join our free newsletter for daily crypto updates!