Feds seize $47K in Tether from Binance account tied to $900K Coinbase text scam Bitcoin theft

Coinbase Text Scam allegations have emerged from a case in which fraudulent messages impersonating the cryptocurrency exchange allegedly enabled scammers to steal 33.7 Bitcoin (BTC) from two wallets belonging to a Massachusetts beneficiary and a family trust. The stolen cryptocurrency was worth approximately $900,000 at the time of the incident in June 2023.

According to the complaint, the incident began while the beneficiary was communicating with Coinbase through email about establishing a separate account for the family trust. The beneficiary subsequently received fraudulent text messages on June 1 and 2, 2023, which appeared to originate from the exchange.

Investigators allege that the messages persuaded the beneficiary to disclose sensitive account information, including login credentials and passwords. This information reportedly gave the perpetrators unauthorized access to both cryptocurrency wallets.

FBI Special Agent Connor Jorde detailed the financial losses in an affidavit accompanying the forfeiture complaint.

“At the time, the wallets, combined, contained 33.7 BTC, valued then at approximately $900,000 (US),” Jorde stated. He added that the trust’s Coinbase wallet alone contained 28.5 BTC.

The remaining Bitcoin belonged to the beneficiary. Following the alleged account takeover, all 33.7 BTC were transferred to other wallets without the owners’ knowledge or authorization.

The Coinbase Text Scam illustrates how impersonation attacks can exploit existing customer relationships to obtain sensitive financial information.

Investigators trace stolen Bitcoin to Binance

Blockchain investigators subsequently identified a portion of the stolen cryptocurrency moving through Binance, another major cryptocurrency exchange.

According to the FBI affidavit, approximately 11.2 BTC from the stolen funds reached a Binance account through transactions conducted between June 5 and June 15, 2023.

However, investigators allege that the cryptocurrency was quickly converted into Monero (XMR), a privacy-focused digital asset designed to make transaction tracing more difficult.

Approximately 75% of the converted Monero reportedly left the account. Attempts to withdraw the remaining balance were unsuccessful, leaving cryptocurrency that investigators could potentially recover.

Following a request from the Federal Bureau of Investigation (FBI), Binance froze the account. At the time of the freeze, it reportedly contained approximately 758.55 XMR.

The account was registered under the name Enrique Mora Morales. However, investigators raised questions about the identity information used during registration.

According to Jorde’s affidavit, Spanish authorities determined that the identification number appearing on the document used to establish the account had not been assigned.

Binance’s records also reportedly showed that approximately 15 approved devices accessed the account between May and November 2023. Investigators cited these details, alongside the account’s transaction history, as evidence supporting their allegations that it was used to receive criminal proceeds.

The investigation demonstrates how cryptocurrency exchanges can become important sources of evidence when authorities attempt to trace assets connected to suspected financial crimes.

US prosecutors seek $110,270 in seized Tether

The latest legal action focuses on recovering cryptocurrency that investigators believe is connected to the alleged theft.

On August 3, 2026, Binance transferred approximately 110,270 USDT associated with the account to a government-controlled wallet. The transfer replaced the frozen Monero holdings and allowed authorities to pursue forfeiture of the recovered assets.

The seized Tether was worth approximately $47,000 when the Justice Department announced the case on September 28.

Importantly, the forfeiture action does not cover the entire 33.7 BTC allegedly stolen from the Coinbase wallets. Instead, prosecutors are seeking legal ownership of the specific USDT recovered from the Binance account.

Civil forfeiture allows the government to seek ownership of property believed to be connected to criminal activity. However, interested third parties can challenge the action by filing claims to the assets.

The government must resolve any such claims before the cryptocurrency can be forfeited and potentially returned to victims.

The case is being prosecuted by Assistant US Attorney Carole E. Head of the Asset Recovery Unit in the District of Massachusetts. US Attorney Leah B. Foley and FBI Boston Special Agent in Charge Ted E. Docks announced the action.

The Coinbase Text Scam remains an allegation detailed in the civil complaint, and the government must establish that the seized cryptocurrency is subject to forfeiture.

Coinbase phishing attacks highlight account security risks

The alleged theft underscores the risks associated with fraudulent messages that imitate legitimate cryptocurrency exchanges.

Unlike attacks that persuade victims to transfer funds voluntarily, the alleged scheme involved obtaining credentials to access an existing account and move cryptocurrency without authorization.

Coinbase’s official security guidance warns customers that its employees will never request passwords or two-step verification codes. The exchange also advises users to be cautious of suspicious communications claiming to require urgent account action.

For cryptocurrency holders, the incident highlights the importance of independently verifying messages before sharing account information or responding to unexpected security requests.

The Coinbase Text Scam also demonstrates the challenges investigators face when stolen digital assets move between wallets and are converted into privacy-focused cryptocurrencies.

Although blockchain transactions can provide investigators with valuable tracing information, recovering stolen funds can become more complicated when perpetrators use multiple wallets, exchanges and privacy-enhancing assets.

The US forfeiture case now offers a legal route to pursue some of the cryptocurrency allegedly connected to the theft. However, the proceedings do not establish that the victims will recover their entire losses.

For now, prosecutors are seeking forfeiture of the $110,270 in seized Tether, while the broader question of recovering the remaining stolen Bitcoin remains unresolved.