Coinbase Tackles $1.1M Crypto Trail as Microsoft Disrupts AI-Powered Phishing Operation

Coinbase has joined forces with Microsoft and other security organizations to disrupt EvilTokens, an AI-powered cybercrime platform that used phishing attacks to compromise email accounts and redirect financial payments. The operation involved tracing $1.1 million in transactions from Tron addresses associated with EvilTokens on Coinbase's platform.

Between October 2025 and June 2026, the Global Intelligence team at Coinbase identified over 1,000 deposits from more than 700 different addresses, tracking the money through the TRON blockchain. This effort was part of a global disruption of EvilTokens' operations, which included seizing 50 websites and blocking over 175 domains in its infrastructure.

The cybercrime platform used AI to help criminals compromise email accounts and redirect financial payments, including cryptocurrency. It accepted cryptocurrency as a service and made money through the addresses of the TRON blockchain. Over 12,000 compromised inboxes were connected to the platform across more than 10,000 organizations, affecting industries such as finance, healthcare, construction, real estate, and higher education.