Coinbase Users Face $300M Annual Loss, $65M Gone in Past Two Months: ZachXBT

Highlights:

• ZachXBT reveals Coinbase users lost millions in social engineering scams. 
• Scammers use spoofed emails, fake IDs, and private data to deceive Coinbase users. 
• ZachXBT urges Coinbase to enhance security or face rising losses and declining trust.

Blockchain investigator ZachXBT revealed that Coinbase users lost over $65 million between December and January due to falling for social engineering scams. This figure only reflects confirmed cases and excludes additional losses reported via Coinbase support tickets or police reports, which ZachXBT could not review. 

ZachXBT claims Coinbase obstructed efforts to trace the stolen funds by failing to flag the theft addresses using compliance tools. He estimated that yearly losses from social engineering scams exceed $300 million. Many customers are unexpectedly locked out of their accounts, preventing them from recovering their lost funds because of the aggressive risk models Coinbase implemented to counter these scams.

1/ Over the past few months I imagine you have seen many Coinbase users complain on X about their accounts suddenly being restricted.

This is the result of aggressive risk models and Coinbase’s failure to stop its users losing $300M+ per year to social engineering scams. pic.twitter.com/PjtX7vmjqc

— ZachXBT (@zachxbt) February 3, 2025

Scammers Use Stolen Data and Phishing Tools to Steal Funds from Users

ZachXBT revealed that one scammer used stolen personal data from private databases to trick a victim into believing there had been several unauthorized login attempts on their account. The scammer then sent a fraudulent email, appearing to be from Coinbase, complete with a fake case ID, and directed the victim to transfer funds to a Coinbase Wallet and whitelist a particular address.

ZachXBT wrote:

“[Scammers] sent a spoofed email which appeared to be from Coinbase with a fake Case ID further gaining trust. They instructed the victim to transfer funds to a Coinbase Wallet and whitelist an address while “support” verified their accounts security.”

ZachXBT’s investigation revealed a troubling aspect of these operations. Criminal organizations now operate Telegram channels where they sell access to phishing control panels, providing new scammers with the tools to target users more effectively.

Onchain sleuth stated:

“Scammers clone the Coinbase site nearly 1:1 and allow the scammers to send different prompts to the target via spoofed emails using panels.”

5/ They then sent a spoofed email which appeared to be from Coinbase with a fake Case ID further gaining trust.

They instructed the victim to transfer funds to a Coinbase Wallet and whitelist an address while “support” verified their accounts security. pic.twitter.com/pOTQpnMfCz

— ZachXBT (@zachxbt) February 3, 2025

Coinbase Faces Security Flaws as Scammers Exploit VPN Blocking Tactics

ZachXBT also pointed out that a Coinbase employee warned users in an X post against using VPNs to avoid having their accounts flagged as suspicious. However, the crypto investigator noted that cybercriminals actively block VPNs on phishing sites to prevent detection. This indicates Coinbase’s failure to properly address security flaws. Onchain sleuth believes this is the primary reason scammers have been able to successfully steal significant amounts of user funds.

ZachXBT Urges Coinbase to Address Rising Scam Threats and User Losses

ZachXBT stressed the urgency of Coinbase’s action, pointing to the growing number of scam victims and losses hitting tens of millions each month. He called for stronger security measures, such as eliminating phone numbers for account recovery, introducing more secure account options for experts, and improving phishing detection.

Without these updates, losses will continue to rise, and user confidence will suffer. He noted that, unlike Coinbase, other major exchanges haven’t faced scammers creating panels for fraudulent activities.

12/ I strongly urge the Coinbase leadership team to consider:

a) Making phone numbers optional for advanced users with Authenticator app or Security key added who are fully KYC verified.

b) Add a beginner / elderly user account type that doesn’t allow withdrawals.

c) Improve…

— ZachXBT (@zachxbt) February 3, 2025