Uncovered Crypto Scams: How Hackers Swindled $65M from Coinbase Users

In the Web3 space, it’s crucial to stay alert, double-check every detail, and dive deep into what’s happening. The digital asset world is rapidly evolving, but with this growth comes new risks that require heightened user awareness. Today, Gemhunt is shedding light on a story where an online investigator uncovered alarming facts about fraudulent schemes targeting users of the largest cryptocurrency exchange, Coinbase.

Recently, a well-known crypto investigator known as ZachXBT reported staggering losses suffered by Coinbase users who fell victim to a complex scam. Between December 2024 and January 2025, criminals swindled over $65 million using social engineering tactics. According to ZachXBT, this figure might not be final—many victims have not yet reported the incidents to Coinbase support or law enforcement, suggesting that the actual damage could be far greater.

Through a thorough investigation, ZachXBT revealed how these criminals carried out their schemes. One of the most common methods involved exploiting stolen personal information from private databases to send convincing fraudulent messages. For instance, scammers impersonated Coinbase in emails, warning users of suspicious login attempts on their accounts. These emails included a fake case ID and instructed users to transfer funds to a Coinbase Wallet while adding a scammer’s specified address to their whitelist. Many users, alarmed by the message, followed these instructions, unknowingly sending their funds to criminals.

In addition, ZachXBT uncovered how fraudsters create nearly identical replicas of Coinbase’s official website to trick users. These counterfeit sites mimic the real ones, with malicious links often spread through phishing emails or even search engine ads. The investigation also highlighted that scammers frequently use Telegram channels to sell tools for such attacks and collaborate with other cybercriminals.

According to ZachXBT’s estimates, the annual damage from such fraud schemes exceeds $300 million, reflecting the magnitude of the problem. He strongly criticized Coinbase for its inadequate response to these threats and failure to take action against the fraudsters. He pointed out that other major crypto exchanges don’t experience as many impersonation cases, suggesting weaknesses in Coinbase’s security infrastructure. Particularly troubling, he noted, is that the exchange often fails to quickly report identified fraudulent addresses, allowing criminals to operate for weeks, or even months, without being blocked.

ZachXBT also raised concerns about misleading advice given by some Coinbase employees. For example, a company representative advised users on an unnamed platform not to use a VPN to avoid suspicion. However, ZachXBT highlighted that real scammers actively block VPN connections to their phishing sites, indicating a lack of understanding of the issue on the part of Coinbase’s representatives.

Referring to a report by The Block, ZachXBT urged Coinbase’s leadership to take immediate action to enhance protection for users against social engineering attacks. As possible solutions, he suggested adding more security features, such as eliminating the mandatory phone number requirement for users who have completed KYC verification, creating a special account type for beginners with withdrawal restrictions, and increasing collaboration with the crypto community to raise awareness of these risks.

In conclusion, Gemhunt wants to remind readers that security in the Web3 space isn’t just a convenience, it’s a necessity. Modern scams are becoming increasingly sophisticated, and the best way to protect your assets is by using advanced security measures. We strongly advise following cybersecurity best practices, carefully verifying incoming messages, and avoiding suspicious links. Remember: your financial safety depends primarily on your vigilance and caution!