Coinbase scammer gets 4–12 years for nearly $16M theft

A Brooklyn court has sentenced Ronald Spektor, 23, to four to 12 years in prison after he pleaded guilty to stealing nearly $16 million from about 100 Coinbase users through a phishing and social engineering scheme.

Summary

• Ronald Spektor received four to 12 years after pleading guilty to all 31 indictment counts.
• Prosecutors said roughly 100 Coinbase users lost nearly $16 million through impersonation and phishing attacks.
• Spektor must forfeit property worth more than $500,000 and pay nearly $16 million in restitution.
• Investigators linked Spektor's home IP address to wallets receiving stolen cryptocurrency from multiple U.S. victims.
• Coinbase helped investigators identify victims, trace funds and gather evidence used to bring criminal charges.

The Brooklyn District Attorney's Office announced the sentence on Sept. 23, saying Brooklyn Supreme Court Justice Danny Chun imposed the indeterminate prison term. Spektor had pleaded guilty on Sept. 2 to the entire 31-count indictment, including first-degree money laundering, first-degree grand larceny and first-degree criminal possession of stolen property.

Under the sentence, Spektor must forfeit cash, cryptocurrency and personal property with an estimated value exceeding $500,000. The court ordered him to pay nearly $16 million in restitution. Prosecutors had sought a prison term of seven to 21 years and opposed the four-to-12-year sentence attached to his guilty plea.

Coinbase scam ended with guilty pleas to all 31 counts

The case followed a yearlong investigation by the Brooklyn District Attorney's Virtual Currency Unit. Prosecutors calculated losses at approximately $15.944 million from around 100 Coinbase users in the U.S., more than 70 of whom investigators interviewed during the investigation.

SENTENCING: Brooklyn Man Sentenced to up to 12 Years in Prison for Stealing Nearly $16 Million in Fraudulent Cryptocurrency Scheme https://t.co/uKNbHAYk2k --- Brooklyn District Attorney Eric Gonzalez (@BrooklynDA) September 23, 2026

District Attorney Eric Gonzalez described the operation as "a digital robbery of nearly 100 victims." His office said investigators used transaction records, blockchain analysis, digital forensics and evidence obtained through multiple search warrants to build the case.

Spektor initially pleaded not guilty after his December 2025 indictment. At the time, attorney Todd Spodek told ABC7 that the transactions were "user-initiated actions" and said the defense disputed the prosecution's case. Spektor later abandoned that position in court by pleading guilty to every count on Sept. 2, 2026.

His sentence came three weeks after the plea. The latest release from the Brooklyn District Attorney's Office did not identify an appeal or another criminal hearing following the Sept. 23 sentencing.

Coinbase users were pushed into wallets Spektor controlled

Prosecutors said Spektor contacted victims while pretending to work for Coinbase. His messages and calls warned users that hackers had compromised their accounts or placed their assets at risk, creating pressure to move cryptocurrency into supposedly secure wallets.

Victims believed the new wallets were under their sole control, according to investigators. Spektor could access the wallets and remove the assets after the transfers arrived. The District Attorney's Office said the stolen cryptocurrency then passed through exchanges, swapping services and mixing services before reaching different cash-out points. Some funds went to cryptocurrency gambling platforms and online stores.

Evidence released when Spektor was indicted provided examples of individual losses. A California victim reported losing more than $1 million, while a Virginia resident reported a loss exceeding $900,000. A Pennsylvania victim lost roughly $53,150 after receiving spoofed two-factor authentication messages before a caller claiming to represent Coinbase contacted him.

Another Maryland victim received calls and emails claiming her wallet had been compromised. Investigators said approximately $38,750 in cryptocurrency was transferred from a wallet she believed she controlled. An email sender involved in the incident identified himself as a Coinbase employee named "James Wilson," according to the December indictment announcement.

Blockchain analysis connected stolen crypto to Spektor

Digital evidence gave investigators a way to follow cryptocurrency after victims transferred it. The District Attorney's Office said Spektor's home IP address was connected to multiple wallets that received stolen funds, while blockchain transaction records helped investigators trace asset movements through different services.

Investigators found evidence that Spektor operated online under the handle @lolimfeelingevil. He ran a Telegram channel named "Blockchain enemies" and used Discord, according to prosecutors. Messages recovered during the investigation showed him discussing thefts and recruiting others to work as social engineers.

Prosecutors said recovered messages indicated Spektor wrote that he had lost $6 million worth of cryptocurrency through gambling and suggested he had earned millions through scams. Phone evidence showed that after online fraud allegations surfaced, he disposed of a cryptocurrency hardware wallet and obtained another one.

During the original investigation, authorities seized approximately $105,000 in cash and $400,000 in cryptocurrency. The District Attorney's Office said at the time that it was working to access more assets believed to be linked to the stolen funds. Coinbase assisted investigators with identifying affected customers, collecting evidence and tracing funds, according to Coinbase Chief Legal Officer Paul Grewal's statement included in the December 2025 prosecution release.

Restitution follows as Coinbase warns about support scams

The Sept. 23 order places the financial recovery process alongside Spektor's prison sentence. He must surrender assets worth more than half a million dollars and make restitution approaching the full $16 million loss calculated by prosecutors. The District Attorney's Office said Senior Assistant District Attorney Joel Greenwald handled the related civil forfeiture case.

The case fits a pattern of support impersonation scams previously tracked by security researchers. In related coverage, crypto.news reported in December 2025 that ZachXBT traced another alleged scammer accused of taking more than $2 million while posing as Coinbase support.

Earlier, crypto.news reported that ZachXBT had identified more than $46 million in suspected Coinbase-user scam losses during March 2025. Those figures came from the investigator's own tracking and were not presented as Coinbase-confirmed loss totals.

Coinbase's current security guidance says its support staff will never ask customers to move funds to a new wallet, disclose a seed phrase, provide passwords or share two-factor authentication codes. The exchange advises users who receive such requests to end the communication and contact its security team through official channels.