Brooklyn man gets up to 12 years over $16 million Coinbase social engineering scheme

A Brooklyn man was sentenced Wednesday to four to 12 years in prison for running a yearlong phishing scheme that prosecutors say drained nearly $16 million from roughly 100 Coinbase users, the Brooklyn District Attorney's Office said.

Ronald Spektor had pleaded guilty on Sept. 2 to a 31-count indictment that included first-degree money laundering, first-degree grand larceny and first-degree criminal possession of stolen property. The office had asked for a sentence of seven to 21 years, but the plea agreement carried the promised term over its objection, according to the statement.

According to prosecutors, Spektor impersonated a Coinbase representative and contacted users with a warning that a hacker was threatening their assets. He then steered them into transferring their cryptocurrency to a new wallet that victims believed they controlled, but which Spektor could access. The operation ran for about a year and produced losses of $15,944,000, with victims located across the United States and drawn from a variety of backgrounds. Some lost $1 million or more.

Tracing and laundering

Investigators tied the scheme to Spektor using transaction records, blockchain analysis, digital forensics and evidence gathered through multiple search warrants. His home IP address was linked to several wallets from which crypto was taken, the office said.

Prosecutors described a layered effort to hide the proceeds: the stolen assets were swapped repeatedly across different crypto exchanges before being consolidated at "cash-out points," where they could be converted into other cryptocurrencies, wagered on bets, turned into cash, or used to buy gift cards and digital assets.

Alongside the prison term, Spektor was ordered to forfeit cash, cryptocurrency and personal property valued at more than $500,000, and to pay close to $16 million in restitution.

Coinbase, one of the largest U.S. crypto exchanges, has repeatedly been targeted by phishing campaigns in which attackers pose as a trusted company through calls, texts, emails or lookalike websites to extract sensitive information. Last year the exchange disclosed that criminals had bribed and recruited customer support agents overseas to steal client data for social engineering attacks. Coinbase said that incident touched less than 1% of its monthly transacting users and that no passwords, private keys or customer funds were exposed.