100 Coinbase Users Scammed Out of Nearly $16 Million

Over recent months, 100 Coinbase customers contacted fake customer support and collectively lost just under $16 million after impostors persuaded them to surrender account access or authorize transfers. The incidents affected users in multiple countries.

Scammers posed as official support and used cloned websites, fake phone numbers, impersonated social media profiles and messages that appeared to come from Coinbase. They persuaded victims to reveal passwords, two-factor authentication codes, recovery seed phrases, or to grant remote access to devices. Once attackers obtained credentials, they moved funds to wallets they control.

Victims reported receiving unsolicited messages about account problems or security alerts, followed by an offer of immediate help through a support link or phone number. Fraudulent support sessions led users to approve transactions or enter recovery phrases that allowed attackers to transfer crypto out of accounts.

Coinbase urged customers to use only in-app support and official website contact methods and to never share passwords, authentication codes or seed phrases with anyone claiming to be support. Coinbase’s guidance states that legitimate support agents will never ask for a user’s full private keys or seed phrase. The company is investigating the incidents and cooperating with law enforcement and cybersecurity partners to track the scammers and attempt fund recovery.

A cybersecurity researcher familiar with the cases warned that attackers are using realistic impersonation and social pressure techniques to lower victims’ defenses and noted that once a recovery phrase is disclosed or a transaction approved the transfer is effectively irreversible.

Affected customers were advised to report the fraud to local authorities and to file reports with relevant financial crime agencies. Security advisers recommended immediate steps for potentially targeted users: change passwords, enable strong two-factor authentication methods that do not rely on SMS, revoke unfamiliar device sessions, transfer remaining assets to hardware wallets if feasible, and avoid clicking links in unsolicited messages.

Crypto accounts are controlled by private keys or seed phrases that grant full access to assets if disclosed. Cryptocurrency transfers are generally irreversible once confirmed on the blockchain, which makes recovery of stolen funds difficult. Exchanges including Coinbase have expanded user education and in-app messaging about fraud risks and official support channels.