Coinbase Users Lose $300M Annually to Neglected Security Vulnerabilities

Coinbase Users Lose $300M Yearly to Social Engineering Attacks

Cryptocurrency exchange Coinbase has been accused of neglecting security vulnerabilities and scam incidents, costing investors millions of dollars each month. According to independent crypto investigators ZachXBT and tanuki42, Coinbase users lost more than $65 million in December 2024 and January 2025 alone, with the actual losses potentially being even higher.

ZachXBT noted that some scams were orchestrated by threat actors from India, primarily targeting US-based customers. While Coinbase advises users against using a virtual private network (VPN) to avoid getting wrongly flagged by its internal security system, the investigators said that scammers explicitly block VPNs from phishing sites, adding, “This shows Coinbase’s failure to diagnose the actual problem.”

The duo added that Coinbase has not addressed some prevalent and ongoing security incidents. As a result, security exploits related to old API keys, a verification code-related bug, and the laundering of stolen funds were made possible on Coinbase. ZachXBT blamed the rise in Coinbase scams on the exchange’s under-reporting of theft addresses in popular compliance tools, “useless customer support agents,” and lack of support for outside US timezone. He said:

“Coinbase needs to urgently make changes as more and more users are being scammed for tens of millions every month.”

In November 2024, a crypto phishing Coinbase scammer said they make “a minimum of five figures a week” by targeting company executives and software engineers. Nick Neuman, co-founder and CEO of Bitcoin self-custody solutions provider Casa, disclosed his recent interaction with a “Coinbase support” scammer. The scammer said:

“We make a minimum of five figures a week. We hit $35K two days ago; we do it for a reason; there is money to be made in it.”

The scammer also revealed they never target “poor people” and contact potential victims from a database containing information about people with at least $50,000.