Umair
Coinbase users are again in the spotlight after losing more than $46 million to social engineering scams this month alone, according to blockchain sleuth ZachXBT.
On March 28, the on-chain investigator reported on his Telegram channel that an unnamed Coinbase user lost approximately 400 BTC—worth around $34.9 million—after being the victim of an elaborate theft.
According to ZachXBT, this theft occurred as part of a broader pattern of targeted incidents affecting US-based exchange users.
He highlighted three different instances of this attack this month. In the first case, the scammers stole 20.028 BTC on March 16, followed by 46.147 BTC on March 25 and another 60.164 BTC on March 26.
After stealing the funds, the attackers reportedly bridged them from Bitcoin to Ethereum using Thorchain or Chainflip, then converted the assets into the stablecoin DAI.
Coinbase’s lethargy
Despite the scale of these incidents, ZachXBT pointed out that Coinbase has yet to flag the associated wallet addresses using its compliance tools.
ZachXBT highlighted that the exchange has consistently failed to flag known theft addresses, suggesting inadequate user protection measures.
He wrote on X:
“I have yet to see an incident where Coinbase flagged theft addresses (they are part of the problem shows they are not taking care of users).”
Earlier this year, ZachXBT revealed that Coinbase users lost around $65 million to scams between December 2024 and January 2025. These losses form part of a more significant trend, with over $300 million reportedly lost annually by Coinbase customers to social engineering scams.
The social engineering scams often begin with spoofed phone calls using stolen personal data. Once trust is established, victims receive phishing emails that appear to come from Coinbase.
These emails warn of suspicious login activity and instruct users to move funds into a Coinbase Wallet. Victims are then told to whitelist a malicious wallet address, unknowingly handing over control of their funds to the malicious attacker.
Coinbase has yet to publicly comment on the incidents as of press time.
Mentioned in this article
