Nick Neuman, the CEO of Bitcoin storage solution provider Casa, recently shared an encounter with a phishing scammer who impersonated Coinbase’s support to steal from high-value cryptocurrency holders.
In a Nov. 20 post on X, Neuman described how he played during a call to discover the depth of the scheme.
Taking advantage of wealthy cryptocurrency holders
The recorded conversation began as a seemingly ordinary phone call with the scammer posing as a Coinbase support agent. It informed Neuman of a “password change request canceled” and directed him to click on a suspicious email link.
However, when Casa’s co-founder revealed his identity and began to question the scammer, he left the event. But instead of ending the call, the scammer openly shared the inner workings of his criminal operation.
“We hit like $35,000 two days ago,” the impersonator said, describing how his scheme exclusively targets people with at least $50,000 worth of crypto. “We don’t call poor people,” he boasted.
According to him, their victims are usually well-educated and highly educated professionals, including software engineers and corporate executives in the crypto space.
“We actually have a guy who was a Chinese software engineer,” the scammer said. “You’d think a software engineer wouldn’t fall for that,” he added, claiming they stole $40,000 from that individual.
He further explained that they rely not on luck but on consistency, making daily calls and receiving visits four or five times a week, each with at least five figures.
How the scheme works
The fraudster detailed how the scams generally work, describing the range of sophisticated and fear-driven methods they use to trick potential victims.
For example, they can claim that a password change request has been cancelled, as they did with Neuman. They would then convince their target to click on a malicious link embedded in a fake notification they would send, ostensibly to solve the password problem.
If a person was unlucky enough to fall for the trick, the phishing pages would capture their sensitive data, including private keys, which the scammers used to create new wallets and divert funds.
To improve their odds, they allegedly use auto-doxxing tools, fake emails that look like official Coinbase communication, and even leaked data from platforms like Unchained Capital to identify potential victims.
These tools allow them to precisely target individuals, often convincing them to send funds directly to wallets under the criminals’ control. Upon receiving the money, scammers use privacy-focused tools like Tornado Cash and Monero (XMR) to cover their tracks.
Neuman’s interaction with the trickster also sheds light on his motivation and audacity. The scammer boasted that he was only a few thousand dollars ahead of a $100,000 goal he aimed to reach in 30 days, with less than five days left for his self-imposed deadline.
It also showed the importance of cryptocurrency holders being extremely vigilant in their interactions as cases increase. Phishing ploys like these exploit trust and fear to fool even seasoned pros. As the scammer noted, “For some reason, people trust people on the phone.”
SPECIAL OFFER (Sponsored) Binance Free $600 (Exclusive to CryptoPotato): Use this link to register a new account and receive an exclusive welcome offer of $600 to Binance (full details).
LIMITED OFFER for CryptoPotato readers on Bybit – Use this link to register and open a FREE $500 position with any currency!