Coinbase Traces $1.1M in Crypto Payments to Help Take Down EvilTokens

Coinbase helped dismantle EvilTokens, an AI-assisted phishing service that Microsoft and the exchange say reached more than 10,000 organizations and compromised more than 12,000 mailboxes worldwide. The operation seized 50 websites and disabled more than 150 related domains. UK police arrested two men on Sept. 11 in connection with the case, according to a CryptoSlate report on the joint response.

What changes for you: some Coinbase users were among the downstream victims, manipulated through hijacked email threads into sending crypto to scam-controlled addresses. Coinbase said the exchange's own accounts and credentials were never breached; the attack rode on compromised business email, not a stolen login.

How the operation worked

Microsoft's investigators said EvilTokens was sold through a Telegram channel. Customers paid a $1,500 initiation fee and a $500 recurring subscription for a toolkit that combined mailbox access, reconnaissance and AI-assisted fraud preparation in one interface.

The phishing relied on Microsoft's device-code authentication flow. An attacker initiates the sign-in themselves, then forwards the resulting code to a target inside an email that looks like an invoice or a shared file. The target who enters the code at Microsoft's legitimate site is completing a sign-in the attacker started, which is how the attacker ends up inside the target's mailbox without ever needing a password.

EvilTokens' AI tools handled the busywork: translating and summarising messages, mapping reporting lines and trusted contacts, surfacing pending invoices and wire conversations, and flagging which employees had authority over payments. Preset prompts could identify an organization's "money movers" and recommend people to impersonate, Microsoft said. Parts of the toolkit were built with AI-assisted coding tools, which lowered the technical bar for both the operators and their customers.

What Coinbase actually traced

Coinbase's Global Intelligence team mapped about $1.1 million in EvilTokens platform revenue across four Tron addresses between October 2025 and June 2026. The exchange said it identified more than 1,000 deposits from over 700 distinct addresses, then followed the funds from payment through to cash-out.

The $1.1 million figure is service revenue, not total victim losses. Coinbase combined the on-chain data with merchant records, device information and open-source intelligence to attribute the platform before referring the matter to London's Metropolitan Police. The same team investigated EvilTokens customers it found on its own platform and referred those cases to law enforcement. Coinbase's evidence also fed Microsoft's civil action against the service.

UK police arrested two men on Sept. 11 in connection with the operation and later released them on conditional bail. Names and nationalities were not given in the source, and Coinbase did not name any indicted operators. Whether further arrests have followed is not stated.

What the model still allows

Microsoft warned that the takedown disrupted infrastructure but did not retire the method. EvilTokens' operator had already signalled plans to extend the toolkit to Gmail and Okta accounts, and Microsoft said the same device-code abuse and AI-assisted fraud workflow can be reused elsewhere.

For organisations, Microsoft recommends blocking device-code authentication where it is not needed and restricting it tightly where it is. Microsoft also flagged a narrower risk: standard session revocation can leave existing access tokens usable for up to an hour, a window recent campaigns have exploited. Security teams, Microsoft said, are left choosing between brief disruption to legitimate users and continued access for someone already inside the mailbox.

For a Coinbase user, the practical read is that an exchange account can be safe while still being the destination for funds stolen by a hijacked email thread. The $1.1 million on the Tron side is what flowed into the service. What came out of victims' pockets beyond that has not been disclosed.