Coinbase, one of the leading cryptocurrency exchanges, is under fire for allegedly neglecting security measures that have reportedly cost its users over $300 million annually. Investigators ZachXBT and tanuki42 have raised concerns about the platform's handling of security vulnerabilities and scams, which have led to significant financial losses for its customers.
Source: tanuki42
Key Takeaways
-
Coinbase users lost over $65 million in just two months due to security lapses.
-
Annual losses attributed to scams could exceed $300 million.
-
Investigators claim that the exchange has failed to address ongoing security issues.
Allegations of Security Negligence
The allegations stem from a report by independent crypto investigators ZachXBT and tanuki42, who claim that Coinbase has not adequately addressed security vulnerabilities that have allowed scammers to exploit its platform. According to their findings, users lost more than $65 million in December 2024 and January 2025 alone, with the actual losses likely being much higher due to unreported incidents.
ZachXBT stated, "Our number is likely much lower than the actual amount stolen as our data was limited to my DMs and thefts we discovered on-chain, which does not account for Coinbase support tickets and police reports we do not have access to."
The Impact of Scams
The investigators highlighted that Coinbase users collectively lost over $300 million in a year due to social engineering scams. Many of these scams were reportedly orchestrated by threat actors based in India, specifically targeting U.S.-based customers.
Coinbase has advised users against using virtual private networks (VPNs) to avoid being flagged by its internal security system. However, the investigators pointed out that scammers often block VPNs from phishing sites, indicating a failure on Coinbase's part to understand the actual security challenges.
Source: ZachXBT
Ongoing Security Issues
ZachXBT and tanuki42 noted that Coinbase has not addressed several ongoing security incidents, including:
-
Exploits related to outdated API keys.
-
Bugs associated with verification codes.
-
The laundering of stolen funds.
The investigators criticized Coinbase for under-reporting theft addresses in popular compliance tools and for providing inadequate customer support, particularly for users outside U.S. time zones. ZachXBT emphasized the urgency for Coinbase to implement changes, stating, "Coinbase needs to urgently make changes as more and more users are being scammed for tens of millions every month."
Scammers' Insights
In a revealing interaction, a scammer targeting Coinbase users disclosed that they earn a minimum of five figures weekly by exploiting the platform. This individual specifically targets individuals with at least $50,000 in assets, indicating a calculated approach to their fraudulent activities.
Nick Neuman, co-founder and CEO of a Bitcoin self-custody solutions provider, shared his experience with a scammer posing as a Coinbase support agent. The scammer claimed, "We make a minimum of five figures a week. We hit $35K two days ago; we do it for a reason; there is money to be made in it."
Conclusion
The allegations against Coinbase highlight significant concerns regarding the security of cryptocurrency exchanges and the potential financial impact on users. As the crypto landscape continues to evolve, the need for robust security measures and responsive customer support becomes increasingly critical. Coinbase's handling of these allegations will be closely monitored by both users and industry experts alike.