The email that knows your password
It usually arrives with no greeting. The subject line is an old password — one you actually recognize, maybe from a job you left years ago. The body claims the sender installed spyware on your device, recorded you through your webcam, compiled a video spliced with the sites you visited, and will send it to your contacts unless a Bitcoin payment lands at the pasted address within 48 hours. Some versions add a sample of the password history, a fake “mail was sent from your own account” header, or a link labeled “view what I have on you.”
Two things in that email are real. Your email address is real, and the password is real — or was, once. Everything else is a template.
The video does not exist. There is no spyware, no recording, no contact list loaded and ready. What you are holding is a mass-mail blast sent to millions of addresses at once, personalized with exactly one data point — a username-and-password pair out of an old breach dump. Researchers at the University of Montreal and Université de Montréal who studied these campaigns in 2019 found the first sextortion emails demanding cryptocurrency appeared in July 2018, and that the waves were pushed out through rented spam botnets such as Necurs and Cutwail — the same industrial mailing infrastructure that ships diet-pill spam (Paquet-Clouston et al., “Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem”, covered by MIT Technology Review).
That single fact should recalibrate your fear. You are not being watched. You are on a mailing list.
Where the password actually came from
The password in the subject line is the hook, and its history explains the whole trick. Services get breached, credential dumps get aggregated, and those dumps get sold and resold among criminals for years. When a blackmail wave goes out, the sender buys a dump, pairs each row’s password with its email address, and mails millions of messages where the only “proof of hacking” is data the victim themselves typed into some other website a decade ago.
That is why the password is so often stale. Many recipients report seeing passwords from accounts they closed years before. It is also why the tactic works: at two in the morning, “they know my password” short-circuits the question of how they know it.
If you want to see your own exposure, free breach-lookup services like Have I Been Pwned will list which known breaches contained your email address. The result usually explains the email you just received with surgical precision — a 2016 forum breach, a 2019 meal-delivery leak, and there is your subject line.
The malware channel exists too, separately. Infostealer malware genuinely harvests saved passwords and browser sessions from infected machines, and its logs feed the same criminal marketplaces. But an infostealer infection produces a rich, current profile — and the blackmail email needs only one old password, which is the signature of a purchased dump, not a live implant. If you want to audit the real risks of that other channel, we cover the infostealer kill chain separately.
What the blockchain says about the senders
Here is the part most victims never do, and it is quietly reassuring: check the Bitcoin address.
Paste the address from the email into any block explorer. Mass-mail sextortion wallets have a recognizable shape — they run for weeks or months, collecting a long tail of small payments, many of them below the demanded amount, because a fraction of terrified recipients negotiate against a script that was never about them specifically. Cisco Talos, dissecting one campaign, found the payment wallets held far less than the campaign’s minimum demand implied it should, and that the same wallets were reused across different attack waves — one collection jar, many letters.
The 2019 academic study went further and followed the money at scale. By clustering the addresses used across campaigns and tracing them through the Bitcoin ecosystem, the researchers concluded that a single entity was likely controlling the financial backbone of the majority of sextortion campaigns they investigated. In other words: the emails looked like a thousand different blackmailers; the cash register was often one operation.
Reading a wallet before you interact with it is a general skill, not a parlor trick. It is the same discipline we use to grade addresses in our wallet labels guide, the same technique behind on-chain address risk scoring, and the same pattern-reading you would apply when checking whether an NFT collection’s volume is real or wash-traded. On-chain history does not lie about what a wallet was built for.
The 2026 upgrade: real breaches, named crews, harassment
For years this scam ran on pure bluff — one old password and a lot of formatting. That changed as breach-extortion crews industrialized, and the sharpest public marker is the FBI’s Internet Crime Complaint Center advisory issued May 15, 2026, on ShinyHunters (IC3 PSA I-051526-PSA).
ShinyHunters specializes in large-scale data breaches, stealing millions of customer records at a time. The extortion emails that follow use what the FBI describes as “real or exaggerated claims of access to sensitive or personal information” to pressure payment. The escalation beyond the old template is behavioral: harassing texts and phone calls to victims and their family members, and in some cases swatting. And the core bluff is still central — the advisory notes the actors may falsely claim to have embarrassing photographs or videos, “which frequently do not exist.”
So the 2026 decision tree has two branches:
- The old template (old password, generic webcam claims, Bitcoin address, countdown): mass-mail bluff. Delete, report, rotate reused passwords.
- The named-crew variant (your data from a specific recent breach, real names, contact info of relatives, calls and texts): the data is real and the harassment is real, but the claimed compromising material is still, in the FBI’s word, frequently fabricated. Do not pay. Verify claims through channels other than the one that contacted you. Save everything — emails, numbers, screenshots — and report. An immediate physical threat is a matter for local police, not for negotiation.
The FBI’s recommended actions in the advisory are worth internalizing because they generalize: verify urgent or unusual requests through a different communication method before responding; do not send payment; do not respond to demands; be cautious of follow-up impersonation — fake emails posing as your school, your provider, or law enforcement.
The second bite: “sextortion assistance” companies
There is a sequel, and the FBI has flagged it too. In April 2023, IC3 issued a public service announcement about for-profit companies that contact sextortion victims offering “assistance” — for a fee (IC3 PSA, April 7, 2023).
The economics are elegant and vile. The victim never reported the original email to anyone. So when a stranger calls days later saying “we can make this go away / remove your data / track the scammer — $1,900 upfront,” the victim assumes help has arrived. It has not. These outfits buy the same victim lists, or trawl for scared people responding publicly, and sell the cure to a crime that was never going to happen. It is the same skeleton as crypto recovery scams and the fake “customer support” crews that contact you first: anyone who initiates contact to sell you relief from a crime you didn’t report is running the second act of the same play.
What to actually do, in order
1. Do not pay. Payment converts you from an address on a list into a verified responder — the only category of recipient worth individual attention. The FBI’s guidance for ShinyHunters-style extortion is explicit: do not send payment or respond to their demands.
2. Do not click, do not “view the evidence.” The link goes to credential phishing or a page engineered to trigger a wallet signature. If your crypto wallet is what worries you, the durable defenses are covered in our airdrop safety checklist and our piece on infinite approvals — the signature, not the password, is what drains wallets.
3. Rotate the exposed password and its siblings. The password in the subject line is burned everywhere you reused it. Change it, and stop reusing: a password manager makes every site’s credential independent. Turn on app-based two-factor for email first — email is the master key that resets everything else. (SMS-based factors have their own failure mode; see our SIM swap walkthrough.)
4. Save the email and report it. Keep the full message with headers, the Bitcoin address, and any numbers that contacted you. In the US, file with the Internet Crime Complaint Center; the May 2026 advisory asks victims to retain usernames, addresses, monikers, and platforms used. Our step-by-step reporting guide covers what a complaint actually does with the evidence. Outside the US, most national cybercrime portals accept these reports — they aggregate, and aggregation is how the botnets and wallets get mapped.
5. Tell one person. These emails are engineered to weaponize shame, and shame thrives on silence. The FBI advisory explicitly points victims to mental-health resources, and it is the correct instinct: the threat is fake, the fear is real, and both get smaller when spoken aloud. If the variant you received involves genuine harassment of you or your family, treat it as the crime it is — document, report, and involve local police for any physical threat.
The red-flag checklist
| Signal in the email | What it actually is |
|---|---|
| Old password in the subject line | A row from a years-old breach dump, not device access |
| ”I recorded you through your webcam” | Template text; the video does not exist |
| 24–48 hour countdown | A conversion tactic from direct-response marketing |
| ”Sent from your own account” | Trivially forged header, a standard spam trick |
| Link to “view the file on you” | Credential phishing or a wallet-signature trap |
| Bitcoin or Monero address, fixed amount | A mass-mail collection wallet, reused across campaigns |
| Named crew + real breach data + calls to family (2026 variant) | Real data, real harassment — but the claimed footage is still frequently fabricated, per the FBI |
| Later: a company offers paid “sextortion help” | The sequel scam the FBI warned about in April 2023 |
The one-paragraph takeaway
The password is real, the video is not, and the wallet at the bottom of the email is a shared collection jar that researchers have watched recycle across campaigns since 2018. The 2026 named-crew variant adds genuine stolen data and genuine harassment — which raises the stakes on reporting, not on paying. Do not pay, do not click, rotate the reused password, save everything, file the report, and talk to one person you trust. Fear is the product being sold; everything in this article is just the refund policy.
Frequently Asked Questions
The email shows a password I really used. Doesn't that prove they hacked my device?
No. It proves your email address and that password appeared together in a database breach at some service you used, years ago. Breach dumps circulate freely among criminals, which is why the password is often years old and already changed. Device access is not needed to know it. If you want to check whether your address appears in known breaches, free lookup services like Have I Been Pwned list which breaches included your email — the presence of an old password in a blackmail email matches that pattern exactly.
Should I pay to make it go away?
No. The FBI's May 2026 public service announcement on ShinyHunters extortion recommends victims do not send payment or respond to demands. Academic tracing of sextortion campaigns (Paquet-Clouston et al., 2019) found the emails were mass-mailed in bulk through spam botnets — paying marks you as a responder, which is the one thing that makes you more valuable than the millions of non-responders on the same list.
What if the email includes my address, phone number, or names family members?
That signals the named-crew variant built on a real breach, like the ShinyHunters campaigns described in the FBI's May 2026 advisory. The data can be genuine while the claimed compromising photos or videos still do not exist — the FBI notes these claims frequently do not. Take the harassment seriously on its own terms: verify any 'we have your data' contact through other channels, save everything, and report it. If you receive an immediate physical threat, treat it as an emergency and contact local police.
Can the Bitcoin address in the email tell me anything?
Yes, and it is worth a look. Paste the address into any block explorer. If it has received a trickle of small payments over months, it is a mass-mail collection wallet — researchers found these wallets reused across campaigns, and payments were often far below the demanded amount, which is what you expect when victims negotiate against a script. Checking what an address has done before you interact with it is the same skill covered in our guide to wallet labels and on-chain risk scoring.
A company contacted me saying they can get my money back or remove my data for a fee. Are they legit?
Treat them as a second scam. In April 2023 the FBI's Internet Crime Complaint Center issued a public service announcement about for-profit companies charging sextortion victims for 'assistance' services. Legitimate help does not cold-call victims of a crime they never reported. This is the same playbook as crypto recovery scams: the criminal sold your fear once, and someone else buys the list to sell you the cure.