Coinbase Users Tricked Into Using Compromised Wallet

A new phishing campaign has been targeting Coinbase users, tricking them into setting up a new wallet with a pre-generated recovery phrase that’s controlled by the attackers. The scam email masquerades as an official communication from Coinbase, instructing users to switch to self-custodial wallets.

The phishing emails, which began circulating in mid-March, claimed that Coinbase users were required to move their assets to self-custodial wallets due to a recent legal decision. The message referenced a class action lawsuit and stated that customers would need to manage their own wallets going forward. The email also provided instructions to download the legitimate Coinbase Wallet app and set up a new wallet using a unique recovery phrase that was included in the message.

However, the recovery phrase was not randomly generated — it was pre-created and managed by the malicious actors. When users followed the provided instructions and established their new wallet, they unknowingly gave the attackers access to their cryptocurrency and NFTs stored in the wallet, which is why this scam differs from typical phishing attempts that try to steal users' recovery phrases.

One distinctive feature of this phishing attempt is the absence of malicious links. Many phishing campaigns rely on links that lead users to fake websites, but this attack used links pointing to the real Coinbase Wallet page.

Coinbase has acknowledged the scam, warning users not to trust any recovery phrase sent by someone else, as it’s likely a phishing attempt. The company emphasized that it will never send users recovery phrases via email or any other method of communication.

For those who may have fallen victim to the scam, it’s crucial to act quickly. If the funds are still in the compromised wallet, users must transfer them immediately to a secure wallet to avoid permanent loss.

This phishing attack highlights the increasing sophistication of cryptocurrency scams, a trend that has been mirrored by a significant rise in phishing incidents. Phishing attacks have surged significantly since 2019, with their numbers increasing by over 150% each year.