News
Massive Coinbase Phishing Attack Tricks Users Into Fake Wallet Migration
<p>A sophisticated phishing campaign is targeting Coinbase users, luring them into transferring their funds to a fraudulent self-custodial wallet. The scheme, disguised as a mandatory wallet migration, exploits users&#8217; trust by providing a pre-generated recovery phrase controlled by the attackers.</p>
<h2>Fraudulent Emails Masquerade as Official Coinbase Notices</h2>
<p>Coinbase customers are receiving deceptive emails with the subject line &#8220;Migrate to Coinbase Wallet,&#8221; urging them to transition to self-custodial wallets. The message falsely claims that a class action lawsuit has forced Coinbase to require users to manage their own wallets.</p>
<p>The phishing email includes a fabricated announcement:</p>
<p>&#8220;As of March 14th, Coinbase is transitioning to self-custodial wallets. Following a class action lawsuit alleging unregistered securities and unlicensed operations, the court has mandated that users manage their own wallets.&#8221;</p>
<p>It also falsely asserts that Coinbase will operate as a registered broker, allowing users to make purchases but requiring all assets to be moved to Coinbase Wallet. The message then provides a pre-generated recovery phrase, instructing users to import it into Coinbase Wallet.</p>
<p><a href="https://www.theibulletin.com/wp-content/uploads/2025/03/Coinbase-phishing-email.jpg"><img class="aligncenter size-full wp-image-56877" src="https://www.theibulletin.com/wp-content/uploads/2025/03/Coinbase-phishing-email.jpg" alt="Coinbase phishing email" width="1051" height="702" /></a></p>
<h2>Phishing Emails Bypass Security Filters</h2>
<p>Unlike traditional phishing attacks that include malicious links, this campaign cleverly avoids common red flags. All the links in the email direct users to Coinbase’s legitimate Wallet page, making it appear credible.</p>
<p>A key detail that exposes the fraud is the sender address: <a>noreply@akamai.com</a>. The email is also being sent from the IP address 167.89.33.244, a SendGrid IP that resolves to o1.soha.akamai.com.</p>
<p>Despite these red flags, the email successfully passes SPF, DMARC, and DKIM security checks, allowing it to bypass many spam filters. This makes the phishing attempt more deceptive, increasing the likelihood that unsuspecting users will fall for it.</p>
<h2>Akamai Responds to Potential Email Exploit</h2>
<p>Security researchers at BleepingComputer reached out to Akamai to investigate whether one of their SendGrid accounts had been compromised. Akamai responded with the following statement:</p>
<p>&#8220;Akamai is aware of reports regarding a potential phishing scam targeting Coinbase users that involves an Akamai email domain. We take information security very seriously and are actively investigating the matter.&#8221;</p>
<p>Akamai warned users to remain cautious about unsolicited emails requesting sensitive information. They urged users to report suspicious messages and avoid clicking on links or entering personal data.</p>
<h2>A Clever Twist on Crypto Theft</h2>
<p>What makes this phishing campaign particularly unique is its method. Instead of tricking users into revealing their own recovery phrases, the attackers provide one themselves.</p>
<ul data-spread="false">
<li>The email instructs users to set up a new Coinbase Wallet using a pre-generated recovery phrase.</li>
<li>This phrase is already controlled by the attackers, meaning they have full access to the wallet.</li>
<li>If users follow the instructions and transfer funds to the wallet, the attackers can immediately steal the assets.</li>
</ul>
<p>By flipping the traditional phishing approach, this campaign avoids some of the usual security warnings and makes users feel like they are following legitimate instructions.</p>
<h2>Coinbase Warns Users to Stay Alert</h2>
<p>Coinbase has acknowledged the scam and issued a warning via its official X (formerly Twitter) account:</p>
<p>&#8220;Reminder: Beware of recovery phrase scams. We&#8217;re aware of new phishing emails going around pretending to be Coinbase and Coinbase Wallet. We will never send you a recovery phrase, and you should never enter a recovery phrase given to you by someone else.&#8221;</p>
<p>For users who have already fallen for the scam but still have funds in the fraudulent wallet, immediate action is required. Transferring assets back to a secure wallet before the attackers access them is the only way to prevent total loss.</p>
<h2>How to Protect Yourself from Similar Scams</h2>
<p>Phishing attacks targeting cryptocurrency users are becoming increasingly sophisticated. Here are a few key ways to stay safe:</p>
<ul data-spread="false">
<li>Never use a recovery phrase provided via email or website. Legitimate wallet setups require users to generate their own phrase.</li>
<li>Verify email senders. Coinbase will never send wallet recovery phrases via email. Always check the sender&#8217;s domain for inconsistencies.</li>
<li>Use two-factor authentication (2FA). Adding an extra security layer can help prevent unauthorized access.</li>
<li>Report suspicious emails. If you receive a fraudulent email, report it to Coinbase and your email provider.</li>
</ul>
<p>This latest scam is a reminder that cryptocurrency users must remain vigilant. The golden rule has always been to never share your recovery phrase—but now, that rule must expand to never use one given to you either.</p>

Mexico’s Safety Divide: What Tourists Really Need to Know
Switch 2 Performance Surprises Fans as Reddit Spreadsheet Tracks Game Boosts and Dips
ChatGPT Codex Rolls Out Multi-Solution Feature to Aid Developers
Sony Hints at Potential PS Plus Price Tweaks to Boost Profit Margins
Google Blames API Mishap for Global Cloud Outage That Disrupted Billions of Requests
Kim Soo Hyun and Kim Sae Ron Controversy Sparks Over 10 Police Investigations Amid Legal Showdown
Joe Biden Diagnosed With Aggressive Prostate Cancer That Has Spread to Bones
Crypto Slumps Over the Weekend as Trade Tensions Cloud Investor Confidence
Claude 4 Cuts Coding Errors by 25%, Gets Faster, Says Vibe Startup Lovable
OpenAI Aims to Simplify Its AI Lineup With GPT-5: One Model to Rule Them All
-
News4 months agoTaiwanese Companies Targeted in Phishing Campaign Using Winos 4.0 Malware
-
News2 months agoJustin Baldoni Hits Back at Ryan Reynolds, Calling Him a “Co-Conspirator” in Blake Lively Legal Battle
-
News4 months agoApple Shuts Down ADP for UK iCloud Users Amid Government Backdoor Demands
