Crypto Users Targeted in Phishing Scam Impersonating Coinbase, Gemini

Cryptocurrency users have been targeted in a new wave of phishing attacks, with major exchanges like coinbase and Gemini being impersonated. The fraudulent emails pressure victims to transfer their digital assets into self-custodial wallets using recovery phrases provided by the scammers. The phishing campaign began over the weekend with mass emails sent to Coinbase users, falsely claiming that due to a court mandate stemming from a class-action lawsuit, users must move their assets to self-managed wallets before April 1. The emails create a false sense of urgency, instructing victims to download the actual Coinbase Wallet app and use pre-generated recovery phrases. These recovery phrases are the critical element of the scam, as they give scammers complete access to any funds transferred to that wallet.

The scam is cleverly designed to appear legitimate, with fraudsters using official logos, similar formatting, and language that mimics real communications from these companies. The emails reference a lawsuit by the U.S. Securities and Exchange Commission (SEC) against Coinbase for allegedly selling unregistered securities. This claim is false, as the SEC dismissed its lawsuit against Coinbase on February 27, 2025. Similar phishing attempts have targeted Gemini exchange users, using the same tactics and claiming users need to set up new wallets because of a recent court decision. The SEC also ended its legal action against Gemini on February 26.

Coinbase has publicly responded to the scam, warning users that they will never send recovery phrases and that users should never enter a recovery phrase given to them by someone else. This latest attack comes during a period of increased phishing activity in the cryptocurrency space. Users who fall victim to these scams typically lose all their transferred funds immediately, as the fraudsters gain instant access to any cryptocurrency sent to the compromised wallets and can drain them within seconds.

Security experts advise crypto users to always verify communications directly through official exchange websites or apps. Users should never use recovery phrases provided by anyone else, even if the source appears to be legitimate. Crypto exchanges recommend enabling two-factor authentication and using hardware wallets for added security. They also emphasize that legitimate companies will never ask users to share recovery phrases or private keys via email, chat, or phone. Community vigilance has played an important role in alerting others to the ongoing phishing campaign, with victims sharing examples of the scam emails on social media platforms.

The SEC’s dismissal of cases against both Coinbase and Gemini in February makes the scammers’ claims particularly misleading. No court has mandated that users of these exchanges must move to self-custodial wallets. This phishing campaign follows reports of other sophisticated scams targeting the crypto industry, including attempts from alleged North Korean hackers who used fake Zoom calls to try to steal sensitive data. The California financial regulator has also issued warnings about new types of crypto and AI scams currently targeting consumers, showing how scammers continue to develop new methods to target cryptocurrency holders.