Coinbase Users Fall Victim to Sophisticated Text Scam

A new text scam is targeting Coinbase users, with attackers sending genuine withdrawal codes to trick victims into authorizing irreversible transfers.

The attack has four stages. First, the attacker already has the victim's credentials from a prior breach or phishing capture. They log in and initiate a withdrawal, which sends a real verification code by SMS to the victim's phone. The attacker then sends a second text, claiming that a withdrawal is in progress and asking the victim to call a number to cancel.

The urgency of the situation prompts the victim to read back the security code to the fake agent, effectively authorizing the transfer. However, legitimate Coinbase security messages come from short codes or official channels, not ordinary ten-digit mobile numbers.

Coinbase has been criticized for its response to the attacks, with on-chain investigator ZachXBT stating that the exchange's internal risk models produced aggressive restrictions on legitimate accounts without stopping the scams. The company has joined the Tech Against Scams coalition and put a $20 million bounty on the group behind an extortion attempt tied to stolen customer data.