Brooklyn man gets up to 12 years over $16 million Coinbase social engineering scheme

A Brooklyn man who ran a yearlong Coinbase phishing operation that prosecutors said pulled in nearly $16 million from about 100 users was sentenced Wednesday to four to 12 years in prison.

Ronald Spektor pleaded guilty on Sept. 2 to a 31-count indictment that included first-degree money laundering, first-degree grand larceny, and first-degree criminal possession of stolen property charges, the Brooklyn District Attorney's Office said in a statement. 

The office had sought seven to 21 years. Spektor's plea deal carried the promised sentence over the office's objection, according to the release.

Prosecutors said Spektor posed as a Coinbase representative and told users that their assets were at risk from a hacker. He then persuaded them to move their crypto to a new wallet that they believed was under their control but was accessible to him.

"The investigation further revealed that the stolen assets were then laundered by swapping them multiple times through different crypto exchanges until they were eventually consolidated at 'cash-out points' where they could be converted to other types of cryptocurrencies, wagered in bets, converted to cash, and used to purchase gift cards or digital assets," prosecutors said. 

The scheme ran for about a year and resulted in losses of $15,944,000, according to the statement. Victims were spread across the U.S. and came from a range of backgrounds. Some lost $1 million or more.

Investigators tied the scheme to Spektor through transaction records, blockchain analysis, digital forensics, and evidence from multiple search warrants. His home IP address was linked to several wallets from which crypto was stolen, per the statement. 

Spektor was also ordered to forfeit cash, cryptocurrency, and personal property worth more than $500,000 and pay nearly $16 million in restitution.

Coinbase, one of the largest U.S. cryptocurrency exchanges, has long been a target for phishing operations, in which attackers impersonate a trusted company through calls, texts, emails, or lookalike websites to extract sensitive information.

Last year, Coinbase disclosed that criminals had bribed and recruited overseas customer support agents to steal customer data for social engineering attacks. The company said the incident affected less than 1% of its monthly transacting users and that no passwords, private keys or customer funds were exposed.