Life occasionally hands you gifts with remarkable comedic timing. Mine arrived on a Saturday morning, in my inbox, under this heartfelt, ever-so-delicate subject line:

YOU PERVERT! I RECORDED YOU!

In block capitals, because nothing says "career criminal" quite like a Caps Lock key stuck down.

The timing, then. I'm right in the middle of my cybersecurity training. I spend my days studying header analysis, phishing, transaction tracing… and the universe, ever the tease, sends me a full-scale hands-on exercise straight to my inbox. Thanks, universe. I grabbed the popcorn.

The "hacker's" pitch

The scenario is a classic, the kind that's been recycled since 2018 without changing a single comma:

  • Some nasty spyware supposedly infected my device.
  • It supposedly had access to my files, my accounts, my webcam.
  • It supposedly filmed me in a, let's say, intimate moment.
  • If I don't pay $800 in Bitcoin, the video goes out to my entire family, my friends, my contacts, and "the darknet."

And the cherry on top, the airtight "proof":

"Check the sender of this email; I sent it to you from your own account!"

Sure enough, in the From field, there it was… my own address. Guaranteed chills for anyone who doesn't know the trick.

Screenshot of the sextortion email received: subject line YOU PERVERT! I RECORDED YOU! and message body demanding $800 in Bitcoin

Except that trick is literally what we learn in class

Putting your own address in the "From" field of an email isn't hacking. It's From-field spoofing at the SMTP level: you write whatever you want as the sender, full stop. It's the digital equivalent of writing "From the President of the Republic" on the back of an envelope. That's never meant the President actually touched your mail.

So: no intrusion, no trojan, no video. My account wasn't compromised. The only thing this guy "hacked" was a form field.

Little bonus for connoisseurs: some variants of this scam quote a real password belonging to the victim (pulled from an old data leak) to scare them. Mine quoted… absolutely nothing. It's the discount version: not even a password to wave around. The bare minimum of intimidation, phoned in.

The moment I'd been waiting for: following the money

This is where my training itched to be put to use. The scammer had left his Bitcoin address in the email — and Bitcoin, contrary to what a lot of people think, is a public ledger. Anyone can read the flows. No account needed, nothing to touch: you just look it up, the way you'd browse a land registry.

Off to mempool.space, I paste in the address, and get ready to run the classic "follow the money" play: spot the inflows, filter out the change, trace the payments to a possible cash-out point on an exchange…

And then, the verdict lands.

Screenshot of the mempool.space explorer: Bitcoin address with a balance and total received of 0.00000000 BTC, 0 transactions and 0 UTXOs

Total received: 0.00000000 BTC. Zero transactions. Zero UTXOs.

This address has never received a thing. Not a single satoshi. The great blackmailer who threatened to ruin my reputation in front of the entire world… collected the equivalent of zero cents.

There was literally nothing to trace. You can't follow money that never moved. My grand tracing investigation stopped at the starting line, and honestly, that was the best possible ending.

Before I celebrate too fast: two honest caveats

Because this is a tech blog and not a comedy sketch, let's be rigorous:

  1. An empty wallet doesn't mean the campaign failed. These scams run on volume. Out of hundreds of thousands of emails sent, it only takes a handful of scared victims to make it profitable. My individual "flop" is actually the statistical norm.
  2. That zero doesn't measure the overall haul. These campaigns often use a different address per victim, specifically to prevent anyone from cross-referencing everything. The scammer may well have cashed in elsewhere — on addresses I have no way of linking to mine.

Bottom line: I won this round, but the house is still open.

What I actually did about it (responsible-adult mode)

No caped-crusader routine. The right move is intelligence-gathering:

  • I reported the Bitcoin address and the message template on Chainabuse, so others can cross-reference it if it resurfaces.
  • In France, you can also go through PHAROS (internet-signalement.gouv.fr), signal-spam.fr for email, and THESEE to file an online police report.
  • And above all: you never pay, you never reply. Replying just confirms the address is live and being read. That's exactly what they're after.

The moral of the story (courtesy of my training)

Getting this attempt while I was literally learning to take these apart was almost too perfect. Three reflexes I'm keeping, and passing on to you:

  • The "From" field proves nothing. A sender address can be spoofed in three seconds.
  • Fear is the scammer's only real tool. No trojan, no hacked webcam: just a script and a mass-mailed email. The day it happens to you, take a breath and smile.
  • Bitcoin isn't anonymous, it's public. And sometimes, what you find there is just a hopelessly empty wallet.

So thank you, dear anonymous hacker, for the impromptu hands-on exercise. You didn't get my $800, but you gave me a blog post. Let's call it even.

⬇ Download the investigation report (PDF)

Got the same kind of email? Whatever you do, don't panic and don't pay. Report it, delete it, and treat yourself to the small pleasure of checking the Bitcoin wallet of the "genius" threatening you. You might be disappointed… for him.