Coinbase Users Report Over $65 Million Lost to Social Engineering Scams, Says Onchain Sleuth ZachXBT
Blockchain investigator ZachXBT has revealed that Coinbase users collectively lost more than $65 million to social engineering scams between December 2024 and January 2025. However, he emphasized that the real figure is likely much higher, as his estimate does not account for cases reported directly to Coinbase support or law enforcement.
In a post on X (formerly Twitter), ZachXBT detailed how scammers exploited stolen personal data from private databases to deceive victims. In one instance, a fraudster convinced a user that their account had been subjected to multiple unauthorized login attempts. The scammer then sent a spoofed email—designed to resemble official Coinbase communication—containing a fake case ID and instructions to transfer funds to a Coinbase Wallet while whitelisting a specific address.
According to ZachXBT, scammers replicate Coinbase’s website with near-perfect accuracy and manipulate victims using fraudulent prompts sent via spoofed emails. He also pointed out that Telegram channels are actively promoting these phishing schemes, making them more accessible to bad actors.
Yearly Losses from Social Engineering Scams Could Exceed $300 Million
ZachXBT estimates that annual losses from social engineering attacks could surpass $300 million, criticizing Coinbase for its inadequate response to such scams.
“Coinbase urgently needs to make changes as more and more users are losing tens of millions every month,” he stated. “Other major exchanges don’t have scammer-controlled panels like these.”
Additionally, he accused Coinbase of failing to report scam-related wallet addresses, even after weeks of fraudulent activity.
Security Concerns: VPN Warnings and Phishing Risks
ZachXBT also highlighted a critical security issue: a Coinbase employee recently advised users on X to avoid using VPNs to prevent their accounts from being flagged as suspicious. However, he pointed out that phishing sites set up by scammers explicitly block VPNs, making Coinbase’s approach ineffective against real threats.
“This demonstrates Coinbase’s failure to properly diagnose the root of the problem,” he added.
Calls for Urgent Security Reforms
To combat the rising number of social engineering scams, ZachXBT urged Coinbase leadership to implement stricter security measures, including:
- Making phone number entry optional for users who have already completed KYC verification
- Introducing a beginner-friendly account tier that restricts withdrawals to reduce risk for new users
- Enhancing community outreach and education to help users identify and avoid scams
With millions at stake and scammers evolving their tactics, the pressure is mounting on Coinbase to step up its security measures and protect its users from further financial losses.
Leave a comment