Four Tron addresses. One thousand and forty-two deposits. Seven hundred and fourteen independent source wallets. Total inflow: approximately $1.1 million.
Those are the numbers that Coinbase's global intelligence team handed to law enforcement, and they are worth staring at precisely because they are so unremarkable. Against a backdrop of nine-figure exploits and bridge drains, $1.1 million reads like a rounding error. That is the anomaly. A phishing platform sophisticated enough to defeat multi-factor authentication, commercialized on Telegram, and operating for at least nine months generated less revenue than a mid-tier NFT mint. The ledger does not lie, it only whispers โ and what it whispered here was not greed, but scale.
I spent two months in 2022 rebuilding the Terra/Luna money flow from block to block. I learned then that the size of a crime tells you almost nothing about its threat. What matters is the geometry of how the money moves. Here, the geometry is retail-shaped, machine-paced, and almost entirely invisible to the compliance systems currently deployed across the industry.
The infrastructure beneath the headline
EvilTokens was not a clever trick. It was a product.
According to disclosures from Coinbase and Microsoft, the platform operated as a phishing-as-a-service (PhaaS) offering โ a subscription-style toolkit distributed through a Telegram bot that let relatively unsophisticated operators run context-aware campaigns. This is the same commercialization curve ransomware traveled between 2015 and 2020, and it carries the same consequence: attack capability decouples from attacker competence. You no longer need to understand OAuth to abuse it.
The mechanics matter here. The operators began with a compromised email inbox. From there, an AI layer mapped two things the defender cannot see: the trust relationships inside that inbox, and the payment permissions attached to it. The output was not a generic "your account has been suspended" lure. It was correspondence written in the voice of a counterparty the victim already trusted, referencing a transaction they were already expecting.
That is the paradigm shift. Traditional phishing is a template fired at a list. This is reconnaissance rendered as social engineering. In forensic terms, the attack surface was never Coinbase's custody layer โ it was the relational metadata sitting in a user's inbox, a dataset no exchange controls and no MFA policy protects.
The MFA bypass nobody priced in
The technical core of the operation was abuse of Microsoft's Device Code Flow โ a legitimate OAuth authorization pattern designed for input-constrained devices like smart TVs and printers.
Under this flow, a user is shown a short alphanumeric code and directed to a vendor-hosted page to approve access. The design assumption is that the person entering the code is the person who initiated the request. EvilTokens inverted that assumption. The attacker initiated the request, then induced the victim โ via an AI-drafted email โ to enter the code on the real Microsoft page and approve the session.
Notice what did not happen. No credential was captured. No session cookie was stolen. No reverse proxy sat between the user and the authenticator. Against a traditional Evilginx-style adversary, MFA holds. Against device code abuse, MFA is not a control โ it is a formality the victim completes voluntarily.
This is why I keep telling institutional clients that MFA status is a lagging indicator of resilience. Enrollment numbers describe intent, not exposure. A firm where 100% of staff have hardware keys and 0% have a device-code conditional access policy is not secure; it is compliant with a threat model from 2019.
I saw the same misalignment during my 2018 review of Curve's early pool algorithm. The code was not broken. The assumptions were. Auditors who checked arithmetic overflow found nothing wrong with the arithmetic โ the vulnerability lived in what the arithmetic implied. Device Code Flow is structurally similar: a valid, spec-compliant mechanism whose real-world blast radius was never fully modeled.
Rebuilding the timeline from block to block
The enforcement action moved on three parallel tracks, and the sequencing tells you more than the outcome.
On the civil track, Microsoft filed suit against the operators and associated domains โ a step that grants access to subpoena power and provisional remedies that criminal procedure cannot deliver on the same timeline. On the criminal track, London's Metropolitan Police arrested an operator and seized digital devices. On the administrative track, 50 websites were taken down and more than 175 associated domains disabled.
The on-chain evidence chain ran underneath all three. Coinbase's intelligence team correlated four Tron settlement addresses to platform revenue, then traced outward to 714 distinct depositor addresses. That is the piece I find most instructive.
Tracing from a cluster of victim addresses back to a collector is routine. Tracing from collector revenue outward to a platform's operational footprint is forensic accounting, and it is what converted a scam into a prosecutable enterprise. You cannot prove a business exists from a single wallet. You can prove it from four wallets receiving 1,042 deposits over nine months with a stable average ticket of roughly $1,050.
Stable average ticket is the tell. It means the operators were not hunting whales. They were running a volume business against retail users making single transfers in the low four figures. That is a genuinely uncomfortable finding for the industry, because volume-based retail fraud is not deterred by large-loss insurance products or by the surveillance architecture built around bridge exploits and exchange hacks. It looks like noise on every dashboard.
There is a second, quieter signal. The entire settlement layer was Tron. Not because of any protocol flaw, but because the cost structure fits. Sub-dollar fees, high throughput, and a compliance perimeter that has improved unevenly make it a rational choice for operators optimizing for volume. Where volume meets volatility, truth emerges โ and the truth here is that network selection in criminal finance follows the same logic as network selection in legitimate payments.
The case against the comforting narrative
The temptation, reading Coinbase's disclosure, is to conclude that the system worked. Platform identified, funds traced, domains seized, operator arrested, no customer accounts compromised. A clean four-act structure.
I want to be careful here, because correlation is not causation and disclosure is not deterrence.
First, Coinbase's statement that no account credentials were compromised is accurate and also jurisdictional. The attack did not breach Coinbase's security perimeter โ it breached its customers' email providers and then relied on the customers themselves to authorize the transfer. Framed that way, the vulnerability is not remediated by anything Coinbase did. It is remediated only by the user, who has no visibility into device-code authorization logs and no reason to distinguish a legitimate consent prompt from a fraudulent one.
Second, the enforcement action is specific, and the methodology is general. One operator was arrested. One platform's domains were disabled. The technique โ AI-assisted reconnaissance plus device-code abuse โ remains fully intact and, based on the revenue figures, was not even especially profitable at the top end. A platform generating $1.1 million across nine months is more likely a mid-market participant than a market leader. If that is the median, the tail is unbounded.
Third, and this is the part I would flag to any institutional reader: the takedown's most durable asset may be the road map. Domain seizure is reversible in hours. Telegram channels can be re-registered. But a document trail establishing exactly how on-chain correlation becomes court-admissible evidence is a permanent artifact. That cuts both ways. It teaches defenders how to build cases. It also teaches operators precisely which on-chain behaviors generate the correlatable footprint โ and the obvious countermeasure, ticket-size fragmentation across a wider address distribution, is cheap to implement.
Mapping the geometry of trust before the collapse is a defensive exercise. Mapping it after disclosure is a blueprint.
What to watch next
The signal I would track is not new arrests but device-code conditional access adoption โ because that is the only control in this chain that closes the actual gap.
One question worth sitting with: if the field's most sophisticated exchanges now produce prosecutable evidentiary records as a matter of routine, at what point does a private intelligence team's correlation work stop functioning as user protection and start functioning as unaccountable enforcement? Coinbase handed law enforcement a case. That is a public good. The next platform may not be run by someone who can be arrested in London.