Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens

What happened

Coinbase traced $1.1 million in crypto behind EvilTokens, an AI phishing service. EvilTokens abused Microsoft's real device-login flow to authorize attacker sessions, then used AI to identify payment authorities inside captured mailboxes.

Confirmed

Global impact / market context

This shows crypto tracing can uncover how stolen access is sold and funded, which may push exchanges and businesses to tighten login checks, monitor wallet flows, and treat phishing tools as financial crime infrastructure rather than only email security.

Analyst inference

For investors, crypto businesses face rising costs from fraud controls, compliance staff, and customer verification. If similar services spread, revenue tied to trading activity may suffer from account lockouts, while security and tracing providers could see more demand.

Analyst inference

What to watch

1. Coinbase traced $1.1 million in crypto connected to EvilTokens, so watch whether more wallet flows or linked accounts are publicly identified later. Confirmed
2. Watch whether Microsoft changes device-login or mailbox permission rules, because that would directly reduce the method EvilTokens used to authorize attacker sessions. Proposed
3. Watch whether exchanges add stricter login checks or pause suspicious accounts, since that could raise costs and slow customer activity for crypto trading platforms. Analyst inference

Evidence

• cryptoslate.com