Texts impersonating Coinbase arrived during a real support exchange and allegedly exposed two wallets under one account. The latest legal step concerns assets traced to part of the loss, with ownership and repayment still to be resolved.
Federal prosecutors in Massachusetts are seeking forfeiture of about 110,270 USDT in an account takeover case involving texts that impersonated Coinbase. Their September 28 announcement concerns a civil action over funds previously seized from a Binance account. It does not establish that victims have already received the money.
How two wallets holding 33.7 BTC were exposed
According to the FBI affidavit attached to the complaint, the alleged theft dates to June 1–2, 2023. A beneficiary of a Massachusetts family trust was exchanging emails with Coinbase about opening a separate account for the trust when text messages arrived that appeared to come from the exchange.
Prosecutors allege that the messages persuaded the beneficiary to disclose a login, password and other access details. A total of 33.7 BTC then left two wallets associated with the same Coinbase account without their owners’ knowledge or consent. Of that amount, 28.5 BTC belonged to the family trust, which held assets for its beneficiaries.
The roughly $900,000 loss cited in the filing is a valuation from the time of the alleged theft, not a fresh loss calculated at today’s Bitcoin price. Nor does the filing allege a breach of Coinbase’s entire infrastructure. It describes phishing: impersonating a trusted service to obtain the credentials needed to enter an account.
From Bitcoin to Monero, then seized USDT
The FBI traced 11.2 BTC of the alleged stolen funds to deposits into a Binance account between June 5 and 15, 2023. The affidavit says the BTC was quickly converted to the privacy-focused cryptocurrency Monero. About 75% of the converted XMR left the account, while attempts to withdraw the remainder were rejected.
Binance froze the account at the FBI’s request. It held about 758.55 XMR at that point, the filing says. Following an October 2024 seizure warrant, Binance transferred approximately 110,270 USDT, in place of the XMR, to a government-controlled wallet on August 3, 2026. Those assets are the subject of the September action.
The token amount and dollar estimate do not align. Both the complaint and the prosecutors’ release specify 110,270 USDT. The release also gives a value of roughly $47,000 without explaining the difference. This report uses the token amount in the filing rather than treating that dollar estimate as verified.
Seizure is not the same as repayment
The civil action seeks to transfer legal ownership of property alleged to be criminal proceeds to the United States. Prosecutors say third parties can claim an interest in the assets, and those claims must be resolved before forfeiture and return to victims. Filing the action does not mean the entire loss has been recovered or that a criminal conviction has been entered.
“The details contained in the civil forfeiture complaint are allegations.”
The notable crypto security detail is the timing: fraudulent texts allegedly arrived during a genuine support exchange. A message referring to an expected topic does not, by itself, authenticate its sender. The next step to watch in this case is the ownership and return of the specific seized assets, rather than a claim that all 33.7 BTC has been recovered.
