Over $65 Million Lost in Coinbase Social Engineering Scams

An onchain investigator known as ZachXBT has uncovered that Coinbase users have lost over $65 million to social engineering scams between December 2024 and January 2025. This figure may be significantly underestimated, as it does not account for unreported cases.

How the Scams Operate

Scammers utilized stolen personal data to execute their schemes. One common method involved sending fake emails appearing to be from Coinbase, alerting users to unauthorized login attempts. These emails included bogus case IDs and instructed victims to move funds to a Coinbase Wallet and whitelist a specific address.

Additionally, scammers created nearly identical replicas of the Coinbase website, allowing them to send deceptive prompts through spoofed emails. Multiple Telegram channels were also used to promote and sell these fake panels.

Annual Losses Exceed $300 Million

ZachXBT estimates that annual losses from such scams surpass $300 million. He criticized Coinbase for failing to adequately address the issue, noting that other major exchanges do not face similar problems with fraudulent panels.

Coinbase's Response Criticized

ZachXBT highlighted that Coinbase often does not report scammers' addresses, enabling thefts to continue for weeks. He also pointed out that a Coinbase employee's advice to avoid VPNs to prevent being flagged as suspicious was misguided, as threat actors typically block VPNs on phishing sites.

Calls for Improved Security Measures

ZachXBT urged Coinbase's leadership to take urgent action to combat these scams. He suggested several measures, including making phone number input optional for KYC-verified users, introducing a beginner account type with restricted withdrawals, and enhancing community outreach to better protect users.

These findings underscore the need for heightened vigilance and improved security protocols in the cryptocurrency space.

Over $65 Million Lost in Coinbase Social Engineering Scams