ZachXBT Reveals $2M Coinbase Impersonation Scam & Onchain Clues

Impersonation Scams in Crypto: Coinbase Support Spoofed Campaign Nets $2 Million in Theft

Recent investigations reveal that sophisticated social engineering scams impersonating Coinbase support agents have led to the theft of approximately $2 million in cryptocurrency. These schemes exploit trust and urgency, emphasizing the persistent threat of low-tech attack methods amid the rising sophistication of cybercrime in the crypto space.

Key Takeaways

• A Coinbase impersonation scam has resulted in losses nearing $2 million, linked by onchain investigator ZachXBT.
• Attribution was based on analysis of onchain activity, social media footprints, and corroborated online communications rather than single transaction evidence.
• Coinbase emphasizes that its genuine support team will never ask for passwords, 2FA codes, or instruct users to transfer funds to new or “safe” addresses.
• These scams are part of a broader wave of internet fraud, with FBI reporting over $16 billion lost to cybercrime in 2024, predominantly through social engineering tactics.

Summary of the Scam

ZachXBT, a prominent onchain investigator, highlighted a classic confidence trick dressed as customer support. An individual pretending to be a Coinbase employee employed social engineering tactics to manipulate victims into transferring funds, resulting in a total theft of around $2 million over the past year.

By examining Telegram group chat screenshots, social media entries, and onchain activity, ZachXBT identified the suspect. The scam relied heavily on creating a sense of urgency and authority, issuing warnings about suspicious activity, and pressuring victims to act quickly to “protect” their assets.

Coinbase’s official stance is clear: their support team will never solicit passwords, seed phrases, or ask users to transfer funds to “safe” addresses. The company repeatedly warns users to verify support communications independently and to avoid clicking links or sharing sensitive information with unknown contacts.

Despite efforts to mask their identities by purchasing premium Telegram usernames and deleting old accounts, the scammer’s online presence, including gloating and lifestyle posts, helped investigators track them down.

ZachXBT: The Crypto Detective

ZachXBT is a pseudonymous online investigator renowned for exposing various crypto scams, hacks, and suspicious fund movements through detailed public threads. His work often precedes official investigations and has been instrumental in bringing criminal figures to justice in the crypto realm.

Official Warnings and Best Practices

Coinbase provides blunt security guidance, warning users that anyone claiming to be from their support team and pressuring immediate action is likely fraudulent. They stress that legitimate support will never ask for passwords, 2FA codes, seed phrases, or request transfers to new addresses.

In light of recent incidents, Coinbase disclosed that some support staff had their internal access compromised, enabling social engineering attacks, but assured that customer funds and private keys remained secure. The key takeaway: personal data can significantly amplify social engineering efforts, making scams more convincing.

Conclusion

As impersonation scams grow more sophisticated, user vigilance remains vital. Always verify communications through official channels, slow down decision-making, and avoid sharing sensitive information with unverified contacts. These scams thrive on stolen context and hurried responses, underscoring the importance of skepticism in the age of digital crypto transactions.