Coinbase Users Lose $45M in a Week to Social Engineering Scams, Crypto Journalist Identifies Key ...

$45M stolen in a week through spoofing and phishing emails impersonating Coinbase.

Known wallet “coinbase-hold.eth” linked to multiple user thefts across blockchain networks.

ZachXBT urges Coinbase to improve verification, support, and theft address flagging systems.

Coinbase users lost $45 million last week through an ongoing wave of social engineering scams, according to blockchain analyst ZachXBT. The losses stem from coordinated phishing operations that continue to exploit weaknesses in Coinbase’s user verification and compliance systems. This development adds to broader theft patterns that have persisted over the past year, with over $300 million reportedly lost to similar scams.

Attackers Use Spoofing and Fake Emails to Bypass Verification

ZachXBT and fellow researcher Tanuki42 traced the latest thefts across multiple blockchain networks. They found that scammers contact victims through spoofed phone numbers using stolen personal information

The attackers convince users to confirm fake account activity, followed by fraudulent emails mimicking Coinbase's official communication. These emails contain fake case IDs and instructions leading victims to whitelist a malicious wallet address through their Coinbase Wallet. Once approved, scammers gain complete access to the user’s digital assets.

Key Wallets and Known Groups Identified in the Operation

Several wallet addresses tied to these thefts were disclosed in ZachXBT’s Telegram update. One recurring Ethereum wallet labeled “coinbase-hold.eth” was seen consolidating stolen funds. In one case, a victim lost $850,000

The wallet reportedly received funds from more than 25 affected users. Two organized groups were named in the investigation. One group operates under the alias “The Com,” while the second is based in India. Both target U.S.-based Coinbase users and rely on cloned websites, phishing panels, and scripts designed to avoid security filters.

Coinbase Accused of Delayed Response and Oversight Failures

ZachXBT reported that Coinbase failed to act on flagged wallet addresses even after multiple thefts were reported. Users cited limited customer support and abrupt account restrictions following the incidents. Additionally, phishing domains often block VPN access, which complicates detection efforts

The report also referred to older Coinbase issues, such as a $15.9 million loss from Coinbase Commerce in 2023 and previous API vulnerabilities. These flaws enabled verification emails to be sent to unauthorized recipients, increasing phishing success rates. To address ongoing scams, ZachXBT proposed changes to Coinbase’s platform. Suggestions included removing phone number requirements for users with authentication apps or hardware keys

He also recommended optional accounts with withdrawal restrictions for older users, improved support for international customers, and proactive user education. Immediate flagging of known theft addresses and public incident updates were also part of the proposed solutions. ZachXBT emphasized that other exchanges have not reported similar issues, making Coinbase a repeated target for social engineering attacks.