Chinese newspaper sounds alarm over Bitcoin blackmail scheme
A major Chinese business daily has cautioned companies to beware of fraudsters posing as its reporters and demanding Bitcoin in exchange for burying supposed negative coverage.
On July 30, China Business Journal disclosed that unknown individuals had been sending threatening emails to firms, claiming to represent the publication. Using an email address hosted on Proton Mail, the impostors allegedly told recipients that “undercover investigations” had uncovered damaging information about their operations.
According to the newspaper’s statement, the senders warned that they would publish these alleged findings unless the targeted companies paid them in Bitcoin. The publication stressed that it had never authorized such messages, described the operation as a suspected extortion scheme and urged businesses not to comply.
Classic impersonation, updated with cryptocurrency
The reported emails appear to merge two common forms of fraud: identity spoofing and reputational blackmail. In this case, the scammers allegedly adopted the branding and authority of a well-known media outlet, then attempted to weaponize the fear of negative publicity to force a cryptocurrency payment.
China Business Journal said the perpetrators presented themselves as its staff or representatives and offered to “resolve” or “suppress” the supposed investigative report if the company agreed to send Bitcoin. The outlet did not publish the full contents of the emails nor reveal which firms had been contacted, underscoring that the allegation is, for now, based solely on its own account.
No suspects have been publicly identified. As of July 30, no Chinese law enforcement agency had announced an arrest, investigation result, or formal criminal case tied directly to these emails.
Extortion using fake journalism is not new in China
While the use of Bitcoin is a relatively modern twist, the general tactic is familiar to Chinese regulators and courts. Authorities have previously prosecuted individuals who pretended to be journalists or exploited the threat of negative news coverage to demand money from companies.
In one case reported by China’s news regulator, three people were convicted for using purported environmental reporting as a pretext to extort 16 businesses. That case involved threats to publish critical stories unless payments were made, illustrating how media impersonation can be turned into a tool for financial coercion.
The new warning from China Business Journal fits into that broader pattern: criminals leveraging the fear of public scandal, regulatory attention, or brand damage to pressure companies into paying up.
Newspaper distances itself and signals possible legal action
China Business Journal made clear that the emails in question did not originate from any of its authorized departments, whether editorial or commercial. The paper emphasized that its investigations follow established procedures and never involve demands for cryptocurrency or secret payments.
The outlet said it is currently collecting evidence about the impersonation attempt and explicitly reserved the right to pursue both civil and criminal liability against those responsible. This could include coordinating with law enforcement, seeking orders to identify account holders, or pursuing damages for reputational harm.
The public notice is also meant as a defensive measure: by openly disavowing the emails, the paper aims to protect its own credibility while warning companies not to treat payment demands as legitimate journalistic outreach.
How to distinguish a real media inquiry from a scam
The newspaper’s warning highlights a key point for corporate communications teams and executives: legitimate journalists may ask uncomfortable questions, but they do not demand payment to suppress stories-especially not in cryptocurrency.
Authentic press requests typically:
– Come from official domains or clearly verifiable contact information
– Identify the reporter, the outlet and the topic of the story
– Seek comment, evidence or clarification on specific issues
– Provide reasonable deadlines and channels for response
Red flags include:
– Requests for Bitcoin or other cryptocurrencies in exchange for favorable or withheld coverage
– Threats of immediate publication unless money is paid
– Use of anonymous or encrypted email addresses that cannot be easily linked to the outlet’s official contacts
– Refusal to verify identity through a phone call, corporate email or publicly listed newsroom contact
China Business Journal’s guidance essentially urges companies to treat any payment demand linked to news coverage as a likely scam.
Why the scam could look convincing
China Business Journal is not a fringe outlet. Founded in 1985, it operates under the supervision of the Chinese Academy of Social Sciences and is organized by the academy’s Institute of Industrial Economics. This institutional backing makes its name familiar in business and policy circles and lends weight to its reporting.
For executives who do not closely track the paper’s official channels or who are unfamiliar with its normal contact methods, an email bearing its name-especially one referencing “investigations”-could seem plausible at first glance. That credibility is precisely what makes impersonation an effective tactic for scammers.
The publication did not disclose any Bitcoin wallet addresses, the amount of money allegedly requested, payment deadlines, or transaction details that might have appeared in the fraudulent emails. It also did not reveal whether any targeted company had actually sent funds.
Because no wallet information has been made public, outside analysts cannot examine blockchain records to determine whether any payouts occurred or to trace potential flows of funds related to the scheme. At present, the only confirmed element is the warning itself.
Proton Mail adds privacy, not proof of identity
The use of Proton Mail, a privacy-focused email service, complicates efforts to identify the senders. Proton’s design emphasizes user anonymity and end-to-end encryption, which can make it harder for third parties to determine who is behind a given account based solely on email headers.
However, Proton does offer channels for reporting abusive or fraudulent activity. Recipients are generally advised to preserve the full original message, including metadata, when submitting a report so that security teams or law enforcement can act if the activity violates laws or the platform’s terms.
China Business Journal has not publicly stated whether it has contacted Proton or Chinese police regarding the impersonation. Any measures such as freezing accounts, requesting user information, or opening a formal criminal investigation would require additional steps coordinated between the service provider and relevant authorities.
Cryptocurrency: new payment rail for an old crime
China’s internet regulator has previously warned that criminals may pose as legitimate news outlets, threaten negative coverage and demand money. What stands out in this case is the reported use of Bitcoin as the preferred payment method.
Cryptocurrency offers several advantages to extortionists: it enables cross-border transfers, avoids traditional banking channels and can give a perception-though not a guarantee-of anonymity. For scammers, it removes the need to open accounts in their own names at conventional financial institutions.
Still, the simple act of demanding Bitcoin does not prove that the fraudsters actually received funds or succeeded in concealing their identities. Blockchain transactions are often traceable, and sophisticated analysis can sometimes connect wallets to specific individuals, especially when they eventually convert crypto into local currency through regulated platforms.
Global pattern of crypto-linked extortion
The reported Chinese case echoes a broader global trend in which criminals blend digital intrusion, impersonation and cryptocurrency payments into complex schemes.
In one high-profile incident, U.S. prosecutors charged a teenager with orchestrating an alleged crypto ransom operation worth millions of dollars, involving corporate intrusions and impostor tactics. In another, a major crypto exchange publicly refused a large ransom after attackers claimed they held stolen customer data and demanded payment in digital assets.
These examples underscore that companies worldwide are facing a similar set of threats: fraudulent actors misusing the names of trusted institutions, exploiting security fears or reputational risk, and insisting on being paid in cryptocurrency.
Practical steps companies can take now
The warning from China Business Journal offers an opportunity for firms to strengthen internal defenses against this type of scam. Useful measures include:
– Training staff, especially those in public relations, legal and executive offices, to recognize extortion attempts masquerading as media outreach
– Verifying any unexpected inquiry by contacting the outlet through official phone numbers or email addresses listed on its site or in print
– Establishing a clear escalation process so that suspicious communications are quickly shared with legal or security teams
– Documenting and preserving any suspected fraudulent emails, including headers and attachments, rather than deleting them
– Considering engagement with law enforcement or industry bodies when clear cases of impersonation arise
By treating unusual demands with skepticism and verifying identities through multiple channels, companies can reduce the likelihood of falling victim to extortion.
What happens next
China Business Journal has indicated that it will continue gathering evidence related to the impersonation campaign. Future confirmed information could emerge from the newspaper itself, from Proton following an internal review, from police statements, or from any company that chooses to publicly disclose receiving such an email.
Until then, the episode serves as a cautionary example. For businesses, it highlights the need to differentiate legitimate investigative journalism from criminal blackmail. For media outlets, it underscores the importance of communicating their official contact procedures, so that when impostors appear, their tactics are easier to spot.