Coinbase Social Engineering Impersonation Scam Network
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·3f1WSc…n41GSummary
A persistent, multi-actor criminal infrastructure that impersonates Coinbase customer support to trick users into transferring cryptocurrency to attacker-controlled wallets. Researchers ZachXBT and tanuki42 estimated annual user losses exceeding $300 million as of early 2025. The network is not affiliated with Coinbase, which has cooperated with law enforcement and published public warnings; the scam operators exploited data stolen in a May 2025 insider breach to make attacks more convincing.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(14 events)
1 April 2023
Ronald Spektor begins operating Coinbase impersonation scheme, per guilty plea. Approximate start date.
CryptoSlate sentencing report26 December 2024
Coinbase insider data theft begins, per the company's May 2025 disclosure. Overseas support contractors start copying user data.
The Register31 December 2024
Ronald Spektor's scheme ends per court record (April 2023 to December 2024 scheme period).
CryptoBriefing sentencing report3 January 2025
ZachXBT documents on-chain consolidation at the 'coinbase-hold.eth' address, which received stolen funds from over 25 victims.
CryptoSlate — ZachXBT $300M report3 February 2025
ZachXBT and tanuki42 publish findings estimating over $300M in annual Coinbase user losses from social engineering. Identify $65M+ stolen in Dec 2024–Jan 2025 alone.
CoinDesk7 May 2025
ZachXBT reports an additional $45 million stolen from Coinbase users in a single week via ongoing social engineering scams.
CryptoSlate11 May 2025
Coinbase receives a $20 million extortion demand from actors who had bribed overseas support contractors to steal customer data.
The Register15 May 2025
Coinbase publicly discloses the insider breach affecting 69,461 users. Refuses ransom and announces a matching $20 million reward for information on attackers.
CCN26 December 2025
Hyderabad police arrest a former Coinbase customer support agent in connection with the May 2025 insider breach. Coinbase CEO Brian Armstrong states further arrests are expected.
Bloomberg5 January 2026
Cointelegraph reports on ZachXBT's on-chain investigation documenting a Coinbase impersonation scam netting an alleged scammer approximately $2 million.
Cointelegraph via TradingView2 September 2026
Ronald Spektor, 23, of Brooklyn, pleads guilty to all 31 counts in state indictment for Coinbase impersonation scheme (April 2023–December 2024) that stole $15.94M from ~100 victims.
The Block23 September 2026
Brooklyn Supreme Court Justice Danny Chun sentences Ronald Spektor to 4 to 12 years in prison. Spektor ordered to forfeit $500K+ and pay $16M restitution.
CoinDesk6 October 2026
Joint Disruption Week begins at NCA headquarters in London. Coinbase, FBI, DOJ, NCA, and partners conduct four-day real-time operation against West African scam networks.
Ministry of Cyber Affairs9 October 2026
Joint Disruption Week concludes. Results: 65+ active Coinbase scam victims identified, $415K in losses prevented, 28 arrests (19 Ghana, 9 Nigeria), 303 devices seized, 30+ scam centers located.
CryptoBriefingDecision Log
- slot 457816576 · hash 2VDwMiJkxu9Abajphjc3kAttYs7vPfH44utepjhtW7zY
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 0 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/16/2026, 11:13:54 PM
last updated: 10/16/2026, 11:13:54 PM
avoid.net — verified advice for a post-truth world