Coinbase Phishing Scammer Gets 4 to 12 Years for $16M Theft

Ronald Spektor was sentenced to four to 12 years in prison for a yearlong phishing operation that stole $15.944 million from about 100 Coinbase users, Brooklyn prosecutors said. He pleaded guilty to a 31-count indictment that included money laundering, grand larceny and criminal possession of stolen property. Prosecutors had sought seven to 21 years, but the plea deal set the sentence over their objection.

Spektor posed as a Coinbase representative and told users their assets were at risk from a hacker. He persuaded them to transfer crypto to wallets they believed they controlled, but which he could access. Some victims lost $1 million or more, and the victims lived across the United States.

Why it matters

The scheme shows how social engineering can bypass the protections users expect from an exchange by persuading them to move assets themselves. Prosecutors said Spektor laundered the stolen funds through repeated swaps across crypto exchanges before consolidating them at cash-out points. The assets were then converted, wagered, or used to buy gift cards and digital assets.

Investigators connected Spektor to the operation using transaction records, blockchain analysis, digital forensics and evidence from search warrants. Prosecutors also linked his home IP address to several wallets holding stolen crypto.

Market impact

Spektor was ordered to forfeit cash, cryptocurrency and personal property worth more than $500,000, and to pay nearly $16 million in restitution. The sentence does not establish how much victims will recover, but the restitution order makes the scale of the losses explicit.

Coinbase has previously disclosed a separate incident in which criminals bribed and recruited overseas customer-support agents to steal customer data for social engineering attacks. The company said that incident affected less than 1% of its monthly transacting users and did not expose passwords, private keys or customer funds. The cases underline the continuing security challenge: attackers can target people and support processes even when platform credentials and keys are not compromised.