A fraudster targeting well-off crypto users revealed his group's inner workings, including stolen databases and laundering tactics.
Nick Neuman, the CEO of Bitcoin storage solutions provider Casa, recently shared an encounter with a phishing scammer impersonating Coinbase support to steal from high-value cryptocurrency holders.
In a November 20 post on X, Neuman described how he played along during a call to uncover the depth of the scheme.
The recorded conversation started as a seemingly ordinary phone call with the con artist posing as a Coinbase support agent. He informed Neuman of a "canceled password change request" and directed him to click on a suspicious email link.
However, when the Casa co-founder revealed his identity and started questioning the scammer, he dropped the act. But instead of ending the call, the grifter openly shared the inner workings of their criminal operation.
"We hit like $35,000 two days ago," the impersonator gloated, describing how their scheme exclusively targets individuals with crypto holdings worth at least $50,000. "We don't call poor people," he bragged.
According to him, their victims are often well-heeled and highly educated professionals, including software engineers and corporate executives in the crypto space.
"We actually got a dude who was a Chinese software engineer," said the swindler. "You'd think a software engineer wouldn't fall for this," he added, claiming they stole $40,000 from that individual.
Further, he explained that they don't rely on luck but consistency, putting in calls daily and getting hits four or five times a week, each netting five figures at a minimum.
The fraudster detailed how the scams generally work, describing the range of sophisticated and fear-driven methods they use to deceive potential victims.
For instance, they might claim a password change request was canceled, like they did with Neuman. They would then convince their target to click a malicious link embedded in a fake notification they would send, ostensibly to resolve the password issue.
If a person were unfortunate enough to fall for the trick, the phishing pages would capture their sensitive data, including private keys, which the conmen then used to create new wallets and siphon funds.
To improve their odds, they supposedly employ auto-doxxing tools, spoofed emails resembling official Coinbase communication, and even leaked data from platforms like Unchained Capital to identify potential victims.
These tools allow them to target individuals precisely, often convincing them to send funds directly to wallets under the criminals' control. Upon receiving the money, the swindlers use privacy-focused tools like Tornado Cash and Monero (XMR) to cover their tracks.
Neuman's interaction with the trickster also sheds light on their motivation and audacity. The scammer boasted about being only a few thousand dollars shy of a $100,000 target he intended to reach within 30 days, with less than five days left until his self-imposed deadline.
It also showed the importance of crypto holders being extremely vigilant in their interactions as cases increase. Phishing ploys like these exploit trust and fear to deceive even seasoned professionals. As the scammer noted, "For some reason, people trust people over the phone."