Coinbase recently got involved in a crypto scam despite never having orchestrated it. Popular Web3 sleuth ZachXBT has revealed details of a $6.5 million social engineering scam involving an individual named Ronald Spektor, alias “Ronaldd.” The scammer allegedly impersonated Coinbase support to defraud a U.S.-based victim. The fraudster raked in $6.22 million in Bitcoin and $262,687.80 in Ethereum at the time.
Details of $6.5M Scam on Coinbase User
In a series of posts on X, ZachXBT detailed the investigation, beginning with a message he received on October 7, 2024, from the victim. “A US-based victim sent me a DM on Oct 7, 2024, after receiving a call from a spoofed number impersonating Coinbase support where they were coerced into using a phishing site,” ZachXBT wrote.
The phishing website was identified as “https://19960018-coinbase.com.” The funds, once stolen, were traced to Ethereum and Bitcoin addresses, where they were quickly converted to Litecoin and transferred to various services. ZachXBT shared the theft addresses as “bc1qr…s6q” and “0x7300…f2d.”
“Just days after the theft, Ronald began flexing his Ledger Live via Discord screenshare, showing $3.1M received on October 8th, 2024,” ZachXBT noted. The Discord ID linked to Ronald was “367190432507232257.”
1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support. pic.twitter.com/8kmLR5Y3cv
— ZachXBT (@zachxbt) November 20, 2024
Further investigation revealed more connections tying Ronald to the crime. ZachXBT stated, “A now deleted Telegram channel in his bio associated with fraud shared screenshots of a wallet address only one hop from the $6.5M theft.” Additionally, a TON blockchain address associated with Ronald’s Telegram number, “EQC7h…Ot4,” was analyzed.
ZachXBT explained, “You can perform a timing analysis to trace through the exchange and find the funding address. That address is tied to multiple other Coinbase withdrawals indicating more potential victims from impersonation scams.”
Were the Lost Funds Recovered?
Public data breaches also played a role in exposing Ronald’s identity. “Multiple data breaches have publicly exposed Ronald’s information such as the Flipd/OG User breaches leaking his email and New York IPs which link to other breaches containing his alleged full name,” ZachXBT wrote.
The case took a grim turn for the victim, who deleted their X account following poor advice. “Unfortunately, this case does not have a happy ending as the victim deleted his X account after receiving bad advice from a friend to not trust people online,” ZachXBT revealed.
In an update, ZachXBT added, “Ronald just deleted his Telegram account.” It remains unclear how the remaining $3.4 million of the stolen funds were distributed or who Ronald’s accomplices may be. However, the victim is stripped off the funds, which are now worth over $12.73 million, almost double of the stolen amount.
Also Read: Bitcoin On New ATH at $94,732: Will Break $100K Barrier Today?
Source: https://www.cryptonewsz.com/did-coinbase-scam-user-6-5m-zachxbt-uncovers/