Cryptocurrency investigator ZachXBT has urged Coinbase to take immediate action after users reportedly lost tens of millions of dollars in social engineering scams between December 2024 and January 2025.
According to a viral thread that has gathered millions of views, ZachXBT and Web3 security researcher tanuki42 compiled reports from victims who had their funds stolen through elaborate phishing schemes.
ZachXBT Calls Out Coinbase Over $65M In User Scams
The duo estimates that at least $65 million was stolen from Coinbase users during this period, though they believe the actual figure is much higher.
The investigation was based on data from victims who reached out to ZachXBT, as well as on-chain findings. This does not include Coinbase support tickets or law enforcement reports, making the true scale of the fraud unknown.
How the Scams Work
The scams primarily rely on social engineering tactics, where fraudsters impersonate Coinbase support agents to trick users into transferring funds. One victim reported losing nearly $850,000 after receiving a call from a spoofed phone number that appeared to belong to Coinbase.
The scammer, armed with personal details likely obtained from data breaches, convinced the victim that their account had multiple unauthorized login attempts.
To further gain trust, the scammer sent a fake email mimicking Coinbase’s official communication, complete with a case ID. They then instructed the victim to transfer funds to a Coinbase Wallet and whitelist an address, claiming it was for security verification.
According to ZachXBT, scammers have been cloning Coinbase’s website almost perfectly, enabling them to send fake security prompts to victims via spoofed emails. Telegram channels are filled with advertisements for such phishing tools, making them widely accessible to criminals.
Coinbase’s Alleged Security Failures
ZachXBT argues that Coinbase’s failure to address these scams has led to users losing over $300 million per year. He also pointed out several security lapses that have made the exchange vulnerable to fraud.
One major issue involves old Coinbase API keys, originally designed for tax software, being exploited despite their supposed read-only permissions. Another flaw allowed scammers to send verification codes to any email, even those unlinked to a Coinbase account.
Additionally, Coinbase was reportedly used to launder $38 million from the BTCTurk hack in just a few hours. In another case, a $15.9 million theft occurred through Coinbase Commerce, yet the exchange did not publicly address the incident.
Victims who reach out to Coinbase for help often find themselves stuck with unresponsive customer support, further amplifying their frustration. ZachXBT criticized the exchange for its lack of 24/7 customer service, noting that competitors like Binance, Kraken, and OKX do not face similar issues.
Also Read: UK’s Financial Regulator Gives Green Light to Coinbase’s Crypto Operations
ZachXBT’s Call for Change
In his statement, ZachXBT made several recommendations for Coinbase to improve user security. He urged the exchange to allow advanced users to opt out of providing phone numbers if they have an authenticator app or a security key.
He also suggested creating a special account type for beginners and elderly users that restricts withdrawals to prevent large-scale scams.
Furthermore, he called on Coinbase to improve community outreach by publishing blog posts on recovering stolen funds, flagging theft addresses, and blocking phishing domains.
He also encouraged the exchange to take legal action against data brokers like TransUnion and TLOxp, which scammers allegedly use to gather personal information on victims.
According to ZachXBT, Coinbase could also pursue legal action against known U.S.-based threat actors running these scams, setting an example to deter future fraud.
He emphasized that while some victims bear responsibility for falling for scams, expecting elderly users to recognize sophisticated phishing tactics is unrealistic.
On-Chain Controversy
As discussions around the Coinbase scam intensified, a new controversy emerged involving ZachXBT himself. An on-chain address linked to the blockchain investigator was found cashing out on a newly launched memecoin.
This unexpected activity has sparked debate in the crypto community, with some questioning the motives behind the move.
Despite the controversy, ZachXBT remains firm in his call for Coinbase to take action. He stressed that the company has the resources and influence to make meaningful changes but has so far failed to act decisively.
With scams continuing to cost users millions, the pressure is mounting on Coinbase to improve its security measures and protect its customers.
Also Read: ZachXBT Exposes $3.5M Crypto Fraud On Memecoins Linked To Social Media Account Hacks