Coinbase traces USD 1.1 million behind EvilTokens, an AI phishing service
The service was sold by subscription and used AI to find, inside stolen email, who can approve payments at a company.
According to CryptoSlate, Coinbase's intelligence team followed about USD 1.1 million in payments across four Tron addresses between October 2025 and June 2026 and passed its analysis to London's Metropolitan Police. That figure is the service's revenue, not victims' losses. EvilTokens targeted about 10,000 organizations and compromised more than 12,000 mailboxes.
Sources: CryptoSlate