News and Analysis

Threat actors are breaching Coinbase accounts through a phishing campaign, bypassing two-factor authentication (2FA) to steal from users’ crypto balances. They use spoofed emails imitating Coinbase and a variety of underhanded tactics to gain credentials and control over accounts. An advanced structure lets them utilize 2FA relay methods to bypass Coinbase’s multi-factor authentication. The stolen funds are then dispersed through multiple transactions across ‘burner’ accounts in an attempt to hide their trail.