Coinbase bitcoin scam cost a family $900,000 — only a fraction recovered

Federal prosecutors in Massachusetts have filed a civil forfeiture case tied to a Coinbase bitcoin scam that stripped a family trust and its beneficiary of 33.7 BTC back in 2023. The case, disclosed in recent court filings, traces how a pair of fake text messages led to one of the more revealing crypto theft investigations in the district, exposing both how far law enforcement can follow stolen funds and where that trail eventually goes cold.

Key takeaways

• Prosecutors in Massachusetts filed a civil forfeiture action over 33.7 BTC, worth about $900,000 at the time, stolen from a Coinbase account in June 2023.
• The theft began with two SMS messages impersonating Coinbase, sent on June 1 and June 2, 2023, that tricked the beneficiary into handing over login credentials.
• Investigators traced 11.2 of the stolen BTC to a Binance account opened in Spain under the name Enrique Mora Morales.
• Some of the funds were converted into Monero, then into Tether, before Binance froze the account at the FBI’s request in August 2026.
• Only a fraction of the original haul has been seized so far, showing how much remains unrecovered.

Massachusetts Federal Prosecutors File Civil Forfeiture for Stolen Bitcoin

The forfeiture case centers on a 2023 account takeover that drained a single Coinbase login controlled by a beneficiary of a Massachusetts family trust. Together, the beneficiary’s personal wallet and the trust’s wallet held 33.7 bitcoin, worth roughly $900,000 at the time, with 28.5 BTC belonging to the trust alone.

According to court papers, the beneficiary was already corresponding with Coinbase by email about opening a separate account for the trust when the scam unfolded. That detail matters: the fraud didn’t come out of nowhere. It arrived at a moment when the victim had every reason to believe communications about the account were legitimate.

Legal Nature of Civil Forfeiture

Civil forfeiture lets the government pursue the assets themselves rather than a named defendant, meaning no criminal conviction is required to move against the funds. Anyone who believes they have a legitimate claim to the seized tokens can file to contest the action, and the complaint itself states plainly that the underlying allegations have not yet been proven in court.

SMS Phishing Scam Enabled Theft of 33.7 Bitcoin from Coinbase Account

Two text messages, sent on June 1 and June 2, 2023, appeared to come directly from Coinbase. Prosecutors allege those messages prompted the beneficiary to share a username, password, and other access details with the scammers behind this crypto phishing attack.

Coinbase’s own security guidance makes clear that its staff never ask customers for passwords or two-step verification codes. That gap between company policy and what actually happened is exactly where this scam operated. Once the scammers had the credentials, unknown actors transferred the full 33.7 BTC out of the account without the owners’ knowledge or consent.

Tracing and Partial Recovery of Stolen Funds Through Binance and Privacy Coins

Investigators managed to follow part of the money. Of the 33.7 BTC taken, 11.2 bitcoin turned up in a Binance account opened in late May 2023 through Binance Spain under the name Enrique Mora Morales. Six separate deposits, totaling just over 11.20 BTC, landed in that account between June 5 and June 15, 2023.

Conversion to Monero and Tether and Account Freeze

Rather than sitting on the bitcoin, whoever controlled the account moved quickly to obscure the trail. Some of the funds were swapped into Monero, a privacy-focused coin built to resist the kind of tracing that blockchain investigators rely on, before the remaining value was converted into Tether. At the FBI’s request, Binance froze the account, and a seizure warrant followed that transferred roughly 110,270 USDT to a government-controlled wallet in August 2026. Prosecutors now want a federal court to forfeit that Tether as property traceable to wire fraud proceeds.

Why this matters: the freeze shows how cooperation between a US-based investigation and an exchange operating abroad can still produce results, even when the money crossed borders and currencies along the way. It also shows how narrow that window of cooperation can be once privacy coins enter the picture.

Challenges in Crypto Theft Recovery and Security Recommendations

The math here tells its own story. Out of 33.7 BTC stolen, only a fraction has actually been clawed back through this bitcoin civil forfeiture action. That gap underscores both what blockchain tracing can achieve and where it runs out of road — once funds pass through mixers or privacy coins like Monero, the trail thins out fast, and recovery becomes far less certain.

Limitations of Blockchain Tracing Against Mixers

Blockchain transactions are permanently recorded, which is exactly what let investigators follow 11.2 BTC to a specific Binance account in Spain. But that same transparency is precisely why scammers route stolen funds through privacy tools designed to break the chain of visibility. The case shows tracing working well for part of the theft and hitting a wall for the rest.

Safety Advice for Coinbase Users

What this case teaches boils down to a few straightforward rules that are worth repeating: never trust unexpected texts pretending to be from Coinbase, don’t hand over your login details or verification codes to anyone, and if you need to check on your account, do it only through the official app or by manually typing the company’s web address rather than following a link. A binance account freeze or a federal forfeiture case can recover some funds after the fact, but neither undoes the moment a password gets typed into the wrong message thread.

This filing is one of several recent civil actions moving through the Massachusetts district aimed at clawing back crypto tied to fraud schemes that targeted local victims. The pattern suggests SMS impersonation remains a persistent vector against exchange users, even years after the original theft in this particular case took place.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.