Archived tweet

Tweet thread by zachxbt:

1/ Over the past few months I imagine you have seen many Coinbase users complain on X about their accounts suddenly being restricted. This is the result of aggressive risk models and Coinbase’s failure to stop its users losing $300M+ per year to social engineering scams. Tweeted at 8:50 AM · Feb 3, 2025 2/ Myself and @tanuki42_ spent time reviewing Coinbase withdrawals and gathering data from my DMs for high confidence thefts on various chains. Below is a table we created which shows $65M stolen from Coinbase users in Dec 2024 - Jan 2025. Our number is likely much lower than Tweeted at 8h 3/ Let’s walk through how these Coinbase social engineering scams work. A victim reached out to me last month after losing ~$850K. Graphing out this theft lead to a consolidation address with 25+ other victims tied to ‘coinbase-hold.eth’. Theft address Tweeted at 8h 4/ The scammer called the victim from a spoofed phone number and used personal information obtained from private dbs to gain their trust. After they told the victim their account had multiple unauthorized login attempts. (Coinbase will NEVER call you) Tweeted at 8h 5/ They then sent a spoofed email which appeared to be from Coinbase with a fake Case ID further gaining trust. They instructed the victim to transfer funds to a Coinbase Wallet and whitelist an address while “support” verified their accounts security. Tweeted at 8h 6/ Scammers clone the Coinbase site nearly 1:1 and allow the scammers to send different prompts to the target via spoofed emails using panels. There are many Telegram channels where scammers advertise them. See examples of various panels used by scammers below. Tweeted at 8h 7/ Last year I posted multiple examples of Coinbase user thefts all for millions of dollars. The two main groups conducting these scams are skids from the Com and threat actors located in India both primarily targeting US customers. Tweeted at 8h 8/ The other month a Coinbase employee told people on X to stop using VPNs to avoid being flagged as suspicious meanwhile threat actors will explicitly block VPNs from phishing sites and not use them. This shows Coinbase’s failure to diagnose the actual problem. Tweeted at 8h 9/ Coinbase has quietly had related security incidents they did not publicly address: a) For a number of users Coinbase with old API keys used for tax software which were hacked (was supposed to be read only perms) b) Recent bugs like one which allowed you to send a Tweeted at 8h 10/ So where does the blame lie? a) For the vast majority of the time these theft addresses are not being reported at all by Coinbase in popular compliance tools even after the thefts went on for weeks. b) Multiple victims who have contacted me get stuck with useless customer Tweeted at 8h 11/ I do not blame all Coinbase employees as most of the fault lies on leadership for these decisions. While this post is critical of Coinbase what have they done well? >providing good stablecoin on-ramp / off-ramp for retail >attracting talent to build on Base >recovery tool Tweeted at 8h 12/ I strongly urge the Coinbase leadership team to consider: a) Making phone numbers optional for advanced users with Authenticator app or Security key added who are fully KYC verified. b) Add a beginner / elderly user account type that doesn’t allow withdrawals. c) Improve Tweeted at 8h 13/ Coinbase needs to urgently make changes as more and more users are being scammed for tens of millions every month. Other major exchanges do not have similar panels created by scammers for fraud. While the victims are partially responsible it’s unreasonable to expect Tweeted at 8h

Tweet #1

Image #1:

Image

Image #2:

Image

Tweet #2

Image #1:

Image

Tweet #13

Image #1:

Image

Tweet #3

Image #1:

Image

Tweet #5

Image #1:

Image

Image #2:

Image

Tweet #6

Image #1:

Image

Image #2:

Image

Tweet #7

Image #1:

Image

Image #2:

Image

Image #3:

Image

Image #4:

Image

Tweet #8

Image #1:

Image

Image #2:

Image

Image #3:

Image

Tweet #9

Image #1:

Image

Image #2:

Image

Image #3:

Image

Image #4:

Image

Tweet #10

Image #1:

Image

Image #2:

Image