Fake Coinbase Texts Led to $900K Bitcoin Theft, US Seeks Seized Crypto

Fake Coinbase Texts Exposed Two Wallets in One Account

A beneficiary of a Massachusetts family trust shared account details after receiving texts that falsely appeared to come from Coinbase, federal prosecutors allege. The U.S. Attorney’s Office for the District of Massachusetts announced a civil forfeiture action Sept. 28 to recover cryptocurrency seized from an account at Binance. Civil forfeiture allows the government to seek legal ownership of property it alleges is tied to a crime.

The beneficiary was exchanging emails with crypto exchange Coinbase (Nasdaq: COIN) about creating a separate account for the trust when the texts arrived June 1 and 2, 2023. At that point, the beneficiary and trust had separate wallets within a single Coinbase account held by the beneficiary. FBI Special Agent Connor Jorde wrote in an affidavit attached to the forfeiture complaint:

“At the time, the wallets, combined, contained 33.7 BTC, valued then at approximately $900,000 (US). Of that amount, the Victim Trust Coinbase wallet had 28.5 BTC.”

The texts allegedly induced the beneficiary to share a login, password, and other details that gave the scammers access to both wallets. All 33.7 bitcoin then moved to other wallets without the owners’ knowledge or consent, the affidavit states. Coinbase’s account security instructions state that its staff will never ask customers for passwords or two-step verification codes.

Investigators Traced Part of the Bitcoin to Binance

Investigators followed 11.2 of the stolen bitcoin to a Binance account through transactions made between June 5 and 15, 2023, according to the affidavit. Bitcoin deposited there was quickly converted to monero, a cryptocurrency designed to conceal transaction details. About 75% of the converted monero left the account, while attempts to withdraw the remaining balance were rejected.

Binance froze the account at the Federal Bureau of Investigation’s request. It held approximately 758.55 monero when frozen, the filing states. Massachusetts prosecutors traced fraud proceeds to Binance accounts in a separate forfeiture action in 2023. The Sept. 28 filing concerns assets linked to the beneficiary’s and trust’s Coinbase wallets.

Criminals have used Coinbase’s name in other thefts, although the methods have differed. In a separate impersonation scheme, a man persuaded users to move cryptocurrency into wallets he could access. The Massachusetts complaint instead alleges that fraudulent texts obtained credentials used to enter an existing Coinbase account.

US Seeks Forfeiture of Crypto Seized From Binance

Binance transferred approximately 110,270 tether (USDT), a cryptocurrency designed to track the U.S. dollar, to a government-controlled wallet Aug. 3, 2026, in place of the frozen monero. The seized USDT represents assets held in the Binance account, rather than all the bitcoin stolen from the two Coinbase wallets. In another federal forfeiture case, authorities began returning recovered stablecoins to a victim after completing the legal process.

The Binance account was held in the name of Enrique Mora Morales, according to the complaint. Jorde alleged that Spanish authorities found the identification number on the document used to open it was unassigned. Binance records also showed that approximately 15 approved devices accessed the account between May and November 2023. The agent cited those records and the account’s transaction activity in alleging that it was established to receive criminal proceeds.

The alleged theft began with messages that appeared to come from an exchange the beneficiary was already contacting. Such phishing and impersonation tactics can obtain the details needed to access an account. In the pending civil action, third parties can assert claims to the seized USDT, and those claims must be resolved before the funds can be forfeited to the United States and returned to victims.