Scam Alert: Fake Coinbase ERC20 Support Email Attempts to Phish Private Keys 🚨 This article is 7 years old...
News ▸ San Francisco ▸ Coinbase ▸ Scams
Scam Alert: Fake Coinbase ERC20 Support Email Attempts to Phish Private Keys
2 min read
Updated: Nov. 7, 2019 at 5:59 am UTC
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
A new phishing email targeting Coinbase users has recently emerged, and appears to be one of the most sophisticated Coinbase phishing attempts to date. Reports from the cryptocurrency community show that the new scam email is attempting to capitalize on Coinbase’s recent announcement of ERC20 token support.
Coinbase announced its intent to integrate ERC20 tokens in a medium post last month, stating that support for the technical standard would be implemented in the “coming months.” The scam email, however, attempts to lure less technically adept crypto investors and traders with a fake announcement that Coinbase ERC20 support is now here, presenting Coinbase users with a complex and convincing phishing operation that is likely to succeed in duping many readers.
No, Coinbase Isn’t Ready to Import ERC20 Tokens
The phishing email, entitled “ERC-20 token support has been added!,” is difficult to distinguish from real Coinbase missives upon casual observation and contains a fairly persuasive announcement stating that:
“Users are now able to import their ERC-20 tokens to their Coinbase accounts, after which you will also be able to trade them on the GDAX exchange. To begin importing your tokens please follow the steps provided.”
The scammers behind the Coinbase phishing email have even included a direct link to the Coinbase blog ERC20 support announcement, which reinforces the credibility of the email.
Following the link provided within the email, however, leads Coinbase users to a process that attempts to “import private keys” — a process that will definitely result in the loss of any tokens contained within associated wallets.
More concerningly, the fraudulent email links Coinbase users to a well-constructed phishing website that is nearly indistinguishable from the real thing — “Coínbasé” dot com, instead of Coinbase. Creative use of accent aigu by the scammers behind the domain make it difficult to identify the fake domain without close scrutiny.
Although it should be common sense, it’s important to note that you should definitely not provide your Coinbase login details or private key data to either the site linked in the fake Coinbase email or during the fraudulent “token importing process”
No Statement From Coinbase
As of this report, there have been no official statements from Coinbase regarding the scam email. While many crypto community members are unperturbed by the scam email, as they are relatively common within the crypto ecosystem, many are speculating on the origins of the data set used by the scammers to launch their email phishing campaign.
It should be noted, however, that the email has been received by individuals that don’t possess a Coinbase account or to emails that aren’t associated with Coinbase accounts, so at this stage it’s unlikely that the campaign is a result of a data leak from Coinbase itself.
