Coinbase joins Microsoft-led takedown of EvilTokens cybercrime platform

September 22, 2026

Coinbase said it partnered with Microsoft to disrupt EvilTokens, an AI-powered cybercrime platform used to steal Microsoft 365 accounts and run financial fraud. The exchange's team joined the global effort by investigating the platform's infrastructure, helping take down domains, and supporting police in arresting operators.

Coinbase also aided the broader investigation, tracing roughly $1.1 million in revenue generated from EvilTokens' paying customers
Part of a multi-company operation that included seizures of phishing-kit websites and arrests of suspects

Sources

We partnered with Microsoft to disrupt EvilTokens, an AI-powered cybercrime platform. Our team joined a global effort to dismantle its operations - investigating infrastructure, taking down domains, and helping police arrest its operators. Say goodbye to another major https://t.co/myu0II6EwXx.com ↗

Coinbase

The most trusted crypto exchange.

View project

Get stories like this in your inbox

Get your digest

Coinbase joins Microsoft-led takedown of EvilTokens cybercrime platform — Outposts