Federal prosecutors in Massachusetts have opened a civil forfeiture case aimed at recovering digital assets they say are connected to a 2023 account takeover that drained 33.7 bitcoin from a single Coinbase (NASDAQ:COIN) login.
According to court papers, a beneficiary of a Massachusetts family trust was already emailing Coinbase about opening a separate account for the trust when two text messages arrived on June 1 and June 2, 2023.
The messages appeared to come from the exchange.
At that moment, the beneficiary and the trust each held a wallet inside one Coinbase account controlled by the beneficiary.
Combined, those wallets held 33.7 BTC, then worth about $900,000. The trust wallet alone contained 28.5 BTC.
Prosecutors allege the texts prompted the beneficiary to hand over a username, password, and other access details.
With that information, unknown actors moved the entire 33.7 bitcoin to other wallets without the owners’ knowledge or consent.
Coinbase’s own security guidance states that its employees never request passwords or two-step verification codes.
Investigators later followed 11.2 of the stolen coins to a Binance account opened in late May 2023 in the name of Enrique Mora Morales through Binance Spain.
Six deposits totaling just over 11.20 BTC arrived between June 5 and June 15, 2023. Some of the bitcoin was quickly swapped into Monero, a privacy-focused coin, before remaining value was converted into Tether.
At the FBI’s request, Binance froze the account.
A seizure warrant followed, and roughly 110,270 USDT was transferred to a government-controlled wallet in August 2026.
Prosecutors value that seized Tether at about $47,000 and now ask a federal court to forfeit it as property traceable to wire fraud proceeds.
Civil forfeiture does not require a criminal conviction of a named defendant.
The government proceeds against the assets themselves.
Anyone claiming an interest in the seized tokens can file a claim and contest the action.
The complaint emphasizes that the allegations have not been proven in court.
The episode illustrates how impersonation by SMS can collapse account security even when a customer is already speaking with a legitimate exchange. Because cryptocurrency transfers are difficult to reverse, a brief lapse in verification can move large sums beyond easy recovery.
Authorities recovered only a fraction of the original 33.7 BTC, underscoring both the value of blockchain tracing and its limits once funds pass through mixers or privacy coins.
Users are repeatedly advised to ignore unsolicited texts that claim to be from Coinbase, never share login credentials or codes, and confirm any account issue only inside the official app or by typing the company’s web address themselves. The Massachusetts filing is one of several recent civil actions in the district seeking to claw back crypto tied to frauds that targeted local victims.