Coinbase Helps Take Down EvilTokens Cybercrime Platform with AI-Driven Phishing Attacks

A cybercrime platform called EvilTokens was dismantled by law enforcement and security organizations after it used AI to compromise email accounts and redirect financial payments, including cryptocurrency. Between October 2025 and June 2026, approximately $1.1 million was traced from several Tron addresses belonging to Coinbase for these crypto assets associated with EvilTokens.

Coinbase joined Microsoft and its partners in disrupting the platform, focusing on tracing the money behind the operation and identifying users connected to the service. Over 1,000 deposits from over 700 crypto addresses were detected in the platform’s payment stream.

The disruption effort included the seizure of 50 websites and disabling over 175 domains associated with EvilTokens. UK police also arrested two men on September 11 as part of the investigation, according to Microsoft and Coinbase.