Phony Coinbase texts led to $900K bitcoin theft

Federal authorities seized roughly $900,000 in bitcoin after fraudulent text messages impersonating Coinbase allowed attackers to access customer accounts, the Department of Justice says. Prosecutors traced transfers from compromised accounts to cryptocurrency wallets now controlled by the government and filed civil forfeiture actions to return the assets to victims.

Victims received SMS messages that appeared to come from Coinbase and were prompted to enter verification codes or follow links. Attackers used the codes or links to take control of accounts, moved bitcoin into a chain of wallets and attempted to obscure the trail.

Investigators used blockchain analysis tools to follow the transfers and identified intermediary wallets where some of the coins were held. Federal prosecutors filed civil forfeiture paperwork in federal court that lists the wallet addresses and describes the assets as property involved in or traceable to the scheme.

Under civil forfeiture law, the government does not need a criminal conviction to seek custody of property. Account holders named in the filing can submit claims in court to challenge the forfeiture and request return of their property or restitution.

Prosecutors identified weaknesses in SMS-based two-factor authentication as a route for the attackers. SMS codes can be intercepted through social engineering, SIM hijacking or malicious links, enabling account takeovers.

Security guidance from exchanges and security experts recommends using authenticator apps or hardware security keys instead of SMS and enabling account safeguards such as withdrawal allowlists and alerts for unusual activity.

Law enforcement has increasingly relied on blockchain tracing to locate stolen funds and to identify where those funds intersect with regulated services, which can allow legal process on exchanges or custodians. When authorities gain control of a wallet or an exchange freezes assets, civil forfeiture actions are used to formalize government custody.

The forfeiture filing starts a legal process for victims to prove ownership. If claimants prevail, a court can order the return of cryptocurrency or restitution; if not, the government may retain the assets under federal law.