Coinbase says that, in the wake of Twitter's hack on Wednesday, it prevented over 1,100 of its customers from sending 30.4 BTC, or ~$275K total, to the hackers
Yogita Khatri / The Block :
Context & Ripple Effects
The July 2020 Twitter hack turned celebrity accounts into bitcoin-scam billboards, and Coinbase's disclosure is the exchange-side countermeasure report: real-time screening flagged the hacker's addresses and froze outbound transfers before they cleared. The episode sits in a long line of social-engineering attacks aimed at Coinbase specifically — going back to the SendGrid account breach used to attack the exchange in 2015, when the weak link was an email provider rather than the exchange itself.
What makes this disclosure more than a one-off is the trajectory in the surrounding coverage: the same playbook kept working at scale, from the [[a:971362|SMS multi-factor flaw that let a threat actor drain 6,000 customers between March and May 2021]] to the [[a:885712|2025 breach where hackers reached a small subset of user data and Coinbase projected $180M–$400M in costs]]. This article captures the moment the defensive side visibly worked.
First-order effects
- Over 1,100 Coinbase customers were stopped from sending 30.4 BTC (~$275K) to the hackers, meaning losses were prevented at the exchange chokepoint instead of being irreversibly lost on-chain.
Second-order effects
- Rival exchanges face pressure to stand up comparable real-time address screening during high-profile scams, since visible failures during the next hack would land on them.
- Scammers whose payout addresses get blacklisted by major venues are pushed toward off-ramps with weaker controls, shifting fraud pressure to smaller exchanges and peer-to-peer channels.
Third-order effects
- Because on-chain transfers are irreversible, exchanges are hardening into a de facto fraud-interdiction layer — yet the corpus shows attackers simply moving upstream to people, from the SendGrid compromise through the SMS MFA exploit to the bribed customer-service representatives behind the 2025 breach, so the arms race migrates from code to human access.
- If the pattern holds, security spend at crypto exchanges shifts toward insider-threat controls and customer-support vetting, with regulators likely to treat repeated social-engineering losses as a systemic consumer-protection issue.
The trend: As social-engineering attacks on crypto holders industrialize, exchanges are becoming both the last line of transaction-level defense and the attackers' preferred target at the human-access layer.