Coinbase and Microsoft Just Took Down an AI Phishing Ring

Meet EvilTokens

Microsoft and Coinbase just worked together, with law enforcement in the mix too, to shut down a phishing operation called EvilTokens. It wasn't your average scam kit. EvilTokens used AI to read through stolen inboxes, spot fraud opportunities, and even write convincing impersonation emails automatically.

The scale is wild: over 12,000 email inboxes across more than 10,000 companies were compromised, and researchers traced roughly $1.1 million in revenue moving through crypto wallets tied to the operation. The takedown seized 50 websites and knocked out more than 150 domains that kept the service running. Two people were arrested in London.

Why It Matters for Crypto

This one's notable because it shows crypto companies stepping up on the defense side of AI-driven crime, not just getting blamed for enabling it. Coinbase helped trace the money, Microsoft handled the legal takedown, and together they dismantled a subscription-based crime service that was charging up to $1,500 per "product." As AI makes phishing scarier and more scalable, this kind of cross-industry teamwork is probably going to become the norm.