The Rise of Coinbase Email Scams-Users Under Attack

Scams are nothing new in the world of crypto, but a recent spike in Coinbase email scams has really caught people’s attention especially since Coinbase is one of the biggest and most trusted crypto exchanges out there. These scams involve fake emails that look like they’re from Coinbase, tricking users into giving up their login info or recovery phrases. Sadly, thousands have already lost their crypto. In some cases, it even involved stolen customer data, making the situation even more serious. In this report, we’ll break down how these scams work, how Coinbase has responded, and most importantly what you can do to stay safe.

What Is the Coinbase Email Scam?

The Coinbase email scam is a sneaky scheme where scammers send emails that look like they’re from Coinbase, one of the biggest crypto exchanges. These emails trick people into setting up new wallets using recovery phrases given in the message. What users don’t realize is that those phrases are controlled by the scammers so once the wallet is set up, the scammers can swoop in and steal the funds. This scam has made headlines because it’s really convincing and has caused serious losses for a lot of people.

The March 2025 Phishing Campaign

In March 2025, a clever and dangerous Coinbase email scam made the rounds, tricking users with emails that looked super legit. These emails claimed Coinbase was switching to self-custodial wallets because of a court order tied to a supposed class-action lawsuit about unregistered securities. The subject lines were things like “Migrate to Coinbase Wallet,” and they asked users to create new wallets using recovery phrases provided right in the email. Here’s the scary part, those recovery phrases were fake they were controlled by scammers. So when people followed the steps and set up their new wallets, the scammers simply used the same phrases to take their crypto.

The emails were very convincing, even passing tech checks like SPF, DMARC, and DKIM, which usually flag suspicious messages. They didn’t even include obvious phishing links just instructions that tricked people into handing over access without realizing it.

Coinbase responded quickly on their official X account with an urgent warning:

“We will never send you a recovery phrase, and you should never enter a recovery phrase given to you by someone else.” – Coinbase Support

To make things worse, the scammers referenced a lawsuit that was actually dismissed by the SEC in February 2025, which made the emails seem even more believable.

The May 2025 Security Breach

On May 15, 2025, Coinbase revealed a major security breach that helped fuel the Coinbase email scam. Here’s what happened, cybercriminals bribed a few rogue overseas support agents to steal sensitive customer data. That stolen info was then used to launch convincing phishing attacks like the fake emails tricking users into handing over their recovery phrases.

Here’s what was exposed:

Good news: No login credentials, 2FA codes, private keys, or direct access to wallets were compromised.

The attackers even demanded a $20 million ransom, but Coinbase refused. Instead, they took strong steps to respond:

• Sent email alerts to affected users from [email protected]

• Promised to reimburse retail users who lost funds to the scam before May 15, after a thorough review

• Launched a $20 million bounty for info that leads to the attackers’ arrest

• Boosted security with better insider-threat detection and opened a new U.S.-based support center

This breach made the email scam even more dangerous because scammers had real customer data—making their phishing emails more convincing and harder to spot.

How the Coinbase Email Scam Operates

The Coinbase email scam works by taking advantage of people’s trust in the Coinbase brand. Scammers send emails that look official complete with Coinbase logos and professional formatting and use urgent language to push users into acting fast. In the March 2025 attack, for instance, the email claimed users had until April 1 to “migrate” their wallets, creating a false sense of urgency. These emails included a pre-generated recovery phrase and told users to download the real Coinbase Wallet app and set it up using that phrase. What victims didn’t know is that the scammers controlled those recovery phrases. So once users moved their funds into these wallets, the scammers had full access and drained them.

What makes this scam especially tricky is how professional and legit-looking it is. The scammers used real email services like SendGrid  and passed all the standard security checks SPF, DKIM, and DMARC which usually help filter out spam and fake emails. And instead of using shady links, the emails relied on social engineering clever wording and psychological tricks to get users to hand over access willingly.

Coinbase’s Response and Security Measures