Inside Coinbase: Hunting Crypto Scammers | "What The Fraud?" Podcast

THOMAS TARANIUK: Hello and welcome to What The Fraud?, a podcast by Sumsub where digital crooks meet their match. I'm Thomas Taraniuk, currently responsible for some of our very exciting partnerships here at Sumsub, a global verification platform helping businesses verify users, companies, and transactions. In this episode, we're talking about crypto fraud, how scams are shifting as money moves online, how blockchain might help to fight back, and why we're always stronger when we tackle it together. In this episode, I'm joined by John Kothanek, Vice President for Global Intelligence at Coinbase, one of the leading platforms for buying, selling, and managing cryptocurrency. John, welcome to What The Fraud?

JOHN KOTHANEK: Thank you very much. Good to be here.

TOM TARANIUK: Well, John, you spent over 20 years investigating cybercrime, working at places like PayPal and now Coinbase as well. You've seen firsthand how quickly fraudsters evolve and how they change their tactics. But before we get into all of that, what is the biggest change that you've seen firsthand since you started?

What’s the biggest change in the evolution of fraud seen over the past 20 years?

JOHN KOTHANEK: I think it's kind of twofold.

The first would be technology being used to, you know, advance their cause, so to speak. We all saw the old phishing attempts 15, 20 years ago that were clumsy—bad grammar, stuff like that. AI and some of these other programs are able to really shift it into the next gear and make it look really good, very professional, do all the spell-checking and sort out idioms for them and all that kind of good stuff.

The second thing is they're working together. Fraud groups are collaborating. You're starting to see fraud as a service. Somebody from Nigeria, for example, will be coordinating with people in two, three, or four other countries, and they will be working together and hiring each other basically to take part in different areas or aspects of the scam.

TOM TARANIUK: When we're talking about fraud, of course, it evolves over time, right? From your perspective, John, what does a modern fraud attack look like in the world of crypto? Talk me through it.

What does a modern fraud attack look like in crypto?

JOHN KOTHANEK: Whether it's pig-butchering or any of the scams where they get you on the phone or engage you via text or email, the first thing they're trying to do is drive urgency.

They want you to be scared, confused, and really alert to a big problem. Once they get you in that mindset, it's much easier for them to push you into the position they want.

So that is the big thing, and they're really, really good at it. For example, we're seeing groups now who have hired former customer-service managers and built software that looks like customer-service software, so they can replicate what a Coinbase admin page would look like, or any other—pick an exchange. That's probably the biggest thing right now, if that makes sense.

TOM TARANIUK: So it's getting super sophisticated, more complex, but that's also because of their access to tools, right? You mentioned fraud-as-a-service, access to AI, and also the interoperability of these networks of fraudsters, which makes it much easier for them to operate on a global scale. John, how have the motivations or profiles, let's say, of fraudsters changed over time? I mean, there's more access for individuals in the retail sector to have digital currencies—access to digital cash—and that makes it maybe more attractive. Are they getting more organized or more decentralized, kind of mirroring the crypto evolution that we're seeing?

Organized crime in crypto

JOHN KOTHANEK: I think it depends on the group. We do see very organized operations—folks at the top directing things almost like a Cosa Nostra model, with isolated cells handling document production or writing the scam script and so on. That's very organized. And then we see others who are basically buying it as a service. That can be anything from the more sophisticated setups we just talked about, to automated systems where you push a button and it goes on autopilot. They blast that out to a million people and, you know, 0.001% respond, they've got somebody on the hook.

Suggested read: 8 Crypto Scams to Be Aware of: A Guide for Businesses and Users

TOM TARANIUK: Makes a lot of sense. John, let's talk about how your global intelligence team uses blockchain and on-chain analytics day-to-day as well. Without getting into any details, which might mean we have to bleep out some information on this podcast, could you share how blockchain data, perhaps combined with machine learning and behavioral insights, helps your team actually trace illicit funds and make sure the culprits are taken forward to, let's say, a prosecutor?

How does blockchain data help Coinbase trace illicit funds?

JOHN KOTHANEK: So, you know, when I first started with Coinbase back in 2014, it was just Bitcoin. We were manually tracking these transactions through the blockchain, and it was fairly simple. There weren’t a lot of mixers back then, and it wasn’t that big of a deal. We were able to pierce most of those just by observing how fraudsters moved their money and changed addresses.

Now it’s much more sophisticated. They’ve got bridging, they can convert to another crypto, all that stuff. And like you said, without giving up too much, we’re able to see through it all.

They think we can’t, but I would say at least 90% of the time, we can get a good picture of who is conducting the crime, where they’re located, and what they’re doing.

It’s very powerful for us. There’s also a ton of excellent analytics companies we use. Coinbase has its own, Tracer. We also use Chainalysis, TRM, Elliptic. What we use them for is data confirmation. Chainalysis might show us something, and then we’ll check it against TRM, look at the same transactions, and say, “Yep, that matches what we’re seeing, matches what Chainalysis is seeing.” That gives us confidence in the analysis.

I would say, maybe we’ll talk more about this later, it also helps us protect privacy, which I don’t think a lot of people discuss. For example, law enforcement might send a subpoena asking about an account. They might say this account holder is suspected of something. Based on some flawed analysis, they could be targeting the wrong person. Because we have strong relationships with teams worldwide working on these cases, we can take a closer look and say, “No, that’s too many hops, too fuzzy, it’s not the person you think it is. This is who we believe it might be.” That way, good customers don’t get a door knock or unnecessary attention. It’s a valuable tool that helps us protect customers from fraud while keeping their privacy secure.

TOM TARANIUK: Most definitely. You’ve mentioned a couple of things there, John—the human-to-human relationships internally, with your teams, and with organizations that help solve these cases are super important. At the end of the day, Coinbase seems to be more proactive than reactive. It sounds like you have a lot of these fraudsters’ scams under review and understand the vectors involved. But with new, creative fraud vectors emerging, are you seeing limits to automation, and how crucial is it still to have humans in the loop at Coinbase?

How crucial is it to have humans in the loop when there’s so much automation in fraud prevention now?

JOHN KOTHANEK: It’s very crucial. On the technology side, we have excellent analysis capabilities, and sharp folks in compliance constantly monitor transactions and escalate cases through SAR reporting. Coinbase has invested a lot of time ensuring that different teams can connect, handle cases correctly, and maintain accurate information. But the human aspect is key. At the end of the day, it’s not just a black-and-white transaction flow. Blockchain analysis can get very complex, lines everywhere, nodes everywhere, and it gets fuzzy sometimes. You need well-trained investigators to pick out details and build the case.

I hope I don’t anger anyone by saying this, but we have a good hold on most of the scams and who is doing them. The challenge is funding for law enforcement and cross-border cooperation. We might know the bad actors and work with agencies like FBI, or Scotland Yard, but they haven’t acted yet for one or two reasons. One, it may not be worth the taxpayer money for smaller cases. Two, cross-border coordination is tricky. You don’t want to arrest someone in Canada while three others remain at large in Singapore because they have resources and will slip away.

It’s a lot of coordination and effort, and it takes time.

What I would tell scammers is: you may be free today, but tomorrow, you might not be, and you probably won’t be within the next year.

TOM TARANIUK: Definitely. And thanks for the reference to Scotland Yard—for everyone listening in the UK. You also mentioned how some individuals escape prosecution because their actions are considered too low value. Are scammers catching on to this threshold, exploiting the fact that exchanges may not cooperate with prosecutors on small amounts? Yet, those microtransactions cumulatively affect hundreds, thousands, or millions of users.

JOHN KOTHANEK: Exactly. That’s exactly how it works. Early in my career, 25 years ago, we saw scammers on the West Coast targeting travelers from the East Coast—credit card fraud, simple scams—because it was hard to get victims to testify across state lines. Many cases fell apart that way. Now, with AI and global technology, it’s a cross-border problem. We have to identify which scam group members to target first—the leaders or the lower-level participants.

We also see scammers exploiting young people. If someone is under 18, they often face lighter sentences. So, scammers entice teenagers: “I can get you a million dollars in a few weeks, and if you get caught, it’s just probation.” That entices them to help larger-scale criminals. It’s diabolical, really.

TOM TARANIUK: Regular listeners of What The Fraud? will know that we recently had the team from Wise discuss educating customers about fraud and bringing them on the anti-fraud journey. That ties into your Consumer Protection Tuesday series, encouraging customers to build safer habits when interacting with digital services, especially in crypto. Could you tell us a bit more about that, John?

How to build safer habits when interacting with digital services?

JOHN KOTHANEK: Yeah, for sure. This is really important to me, and I’m glad we have people like you spreading the word. I compare it to driving a car: I check my seatbelt, make sure the car runs well—that’s how I stay safe. The same applies online.

Before you start financial transactions, you need to be safe: have a VPN, good virus protection, and understand the world they’re operating in and the scams they might encounter.

With Protection Tuesdays, we aim to give people that awareness. We hear from customers that they avoided scams because they recognized warning signs from our posts. Awareness and vigilance protect them better than any software or bank guarantee.

TOM TARANIUK: Absolutely. Trust in crypto is essential in the business-to-consumer relationship. Customer education is crucial. For everyone listening, we’ll link information in the show notes about Coinbase’s work. Even with education, scammers evolve fast. If someone falls victim to a scam, what should they do?

If someone falls victim to a scam, what should they do?

JOHN KOTHANEK: First, report it locally. In the US, contact local police. If it involves Coinbase, let our team know—we can guide investigators who may have never worked a crypto case. We provide training and help them analyze blockchain evidence.

Also report to the FBI’s IC3. Even if a case is too small locally, IC3 can link it to other cases, helping push for federal prosecution and cross-border arrests. In Europe or Asia, report to local law enforcement. No matter where you are, law enforcement involvement is critical.

We all share the same goal: stopping bad actors and protecting customer privacy. Law enforcement enables us to implement the kill chain quickly. First steps always go to law enforcement—they’re essential in stopping scams efficiently.

TOM TARANIUK: Makes a lot of sense. And I wish, of course, that when people are scammed or become victims of these kinds of crimes, they actually report it. Under-reporting is an international issue that we see. But one great thing that you have is these relationships with prosecutors and international agencies that genuinely want to do the right thing. Coinbase recently worked with the US Secret Service to seize $225 million in stolen crypto. I mean, that’s an amazing figure, and it’s also a very exciting case. Could you tell us a little bit about the story behind it, John?

The story behind Coinbase’s $225M crypto recovery operation

JOHN KOTHANEK: Yeah, so it started off as a typical pig-butchering case. For listeners who aren’t familiar with pig-butchering, essentially—I think we’ve all probably gotten a text like this—you get a message on your phone saying, “Hey, Bob, this is Elaine from so-and-so. I just landed at the private airport, got off my private jet, and I don’t have my ride here. What’s going on?”

Most of us are nice people and will respond, saying, “Hey, Elaine, you’ve got the wrong number,” or something like that. They’ll reply, “Wow, thanks, you’re very nice. I really appreciate it. Can we start talking and be friends because you’re such a good person?” There are a lot of lonely people or people who enjoy communicating, and they respond. Next thing you know, they’re being enticed into investing in crypto because they’ve been convinced that the scammer is wealthy—flying on private jets, riding in limos, or whatever image you want to pick.

They’ve already gotten into your head that they’re successful, good at making money, and can help you make money. And it’s never the case—it’s always a scam.

We spent a lot of time, with help from our counterparts at Coinbase, compliance folks, special investigations, and other teams. Also, other exchanges like Gemini and Binance helped track where the crypto went. Together, we compiled a strong evidence package for law enforcement. They were able to recover a significant portion of the stolen crypto—still just a portion, but they seized $225 million. The process takes a while to return funds to victims, but they’ll be made as whole as possible.

TOM TARANIUK: Amazing to hear. From $20 million spoofing scams to $225 million with the Secret Service, you’ve given a perspective on effective collaboration between investigators and exchanges like Coinbase. Working with law enforcement is clearly a big part of fighting fraud, but so is maintaining customer trust. You mentioned PII earlier. How does Coinbase balance helping investigations with protecting user privacy, especially in crypto, where privacy is critical?

How does Coinbase balance helping investigations with protecting user privacy?

JOHN KOTHANEK: There are times when law enforcement wants to get a case done quickly. Sometimes they reach out to a smaller company and ask for information, and it’s given out quickly without proper process. As a company matures, it learns that it can’t do that. At the end of the day, it’s our responsibility to safeguard our customers’ treasures—their PII and their crypto. It matters to me and my team that we protect their privacy.

As I mentioned, we double-check the work because not everyone is up to speed on blockchain analysis. Sometimes mistakes are made, and we correct them. Because we’ve trained many of these folks, we have great relationships, have sat in rooms with them, and can confirm: “Yes, your analysis is correct. That person did not do this.” You don’t want the government creating a permanent record unnecessarily. We work hard to protect customers’ rights and privacy. We don’t give out information for free—there’s a process. Law enforcement is excellent at this now; they think ahead. Instead of just trying to finish the job quickly, they consider whether the documentation will hold up in court. This works really well. So it’s a joint effort—both Coinbase and law enforcement are protecting users’ privacy while pursuing fraudsters.

TOM TARANIUK: Absolutely. Having diligence from prosecutors provides confidence in the process. What have been the biggest technical or operational challenges you’ve faced? The process can be lengthy, especially for victims providing detailed information. It requires patience.

JOHN KOTHANEK: Trust me, we understand. Sometimes, Coinbase is the victim of a crime, so we experience it firsthand. Resolution and court proceedings can take a long time. I’ve worked e-commerce cases that took 12 years to close—that’s the upper edge of my experience. Patience is essential. Just because someone can’t be prosecuted today, maybe because they’re in another country, doesn’t mean it won’t change next week. For example, even bad actors go on vacation—if they’re in a country with better law enforcement relations, the FBI can reach out to have them taken into custody for extradition. It takes time and patience.

Frustration often comes from having to stay close to the vest regarding case details. Victims won’t get all the information they want because preserving the case and the chain of evidence is crucial. When arrests happen, the evidence must stand up and lead to convictions.

TOM TARANIUK: Absolutely. Individuals are only tried if there’s a strong chance of prosecution, which explains the long timelines. Given the challenges, are there policies you would change to make the process smoother for retail users who have been scammed?

Which policies should be changed to make the investigation process smoother?

JOHN KOTHANEK: Definitely. A couple of years ago, I testified before Congress. One thing I emphasized is that law enforcement needs the budget, personnel, and training to pursue these cases, including cross-border investigations. Prosecutors need motivation and resources to go after criminals in other countries. The biggest challenge now is ensuring law enforcement has the tools and incentive to reach across borders with the help of local authorities. The will is there—the limitation is often the budget from governments.

TOM TARANIUK: I can imagine. Especially when prosecutors need evidence, which exists, but accessing it is never straightforward.

We've been talking a lot about collaboration and trust, and that connects perfectly to the transparency work that you're doing at Coinbase as well. In a landmark move, Coinbase has teamed up with other major tech organizations globally to tackle online fraud as a whole, including the rise of pig-butchering scams, which we discussed earlier—where fraudsters groom their victims before stealing their money or, in some cases, their identity. Let's talk about tech against scams. How did that partnership come together, John? And how important is it to work collaboratively with these other tech organizations to combat fraud?

Tech against scams

JOHN KOTHANEK: Yeah, it's such an important point. Thanks for bringing it up. I think the way it came about is that everything from career websites to online romance sites—a lot of these scams start there—plays a role in how fraudsters first contact victims. Then you have all the other companies involved between that point and the financial side. All of these organizations together hold pieces of information and evidence that we can put together to help identify the bad actors. That’s why it’s becoming easier for us to track them.

Now, with this collaboration among all these different groups, we’re able to sit in rooms or get on web conferences and discuss: what are you seeing? What’s the trend right now? Do you have anything involving this crime or potential scam? When you get a group of smart people—far smarter than I am—talking and engaging with each other, it rings bells. You’d be surprised at how often these conversations lead to significant efforts. That’s the best part: learning from other companies, collaborating, and ensuring law enforcement has the necessary information when making arrests and taking cases to trial.

TOM TARANIUK: 100%. Innovation doesn’t happen behind closed doors. You need to come together, put your heads together, and solve problems. That’s what I love about the fraud space and why we have this podcast: we can talk about these subjects openly. It’s a balancing act, isn’t it? Managing relationships with prosecutors and international agencies from the UK, the US, and beyond, while also coordinating with tech firms, all while maintaining trust with retail customers who expect their private information to remain private. That’s super important.

I know that for the last six years, Coinbase has been publishing Transparency Reports that provide customers with data about requests made by government agencies and law enforcement. John, why is publishing that report every year such a priority for Coinbase?

Coinbase's Transparency Reports: Why they matter

JOHN KOTHANEK: You know, one thing that you’ll see with customers, or the public in general—and I’m sure you talk a lot about this when it comes to privacy—is that there’s a lot of misinformation out there. We want customers to see the truth, to know who’s requesting information. My team is not dealing with law enforcement on “phishing expeditions.” They’re not going out on the blockchain saying, “Wow, that’s a big wallet; they must be doing something wrong.” They’re tracking criminal activity to wallets and addresses.

When law enforcement sends us a subpoena, we have strong case management. The transparency report provides customers with that extra layer of information, so they can feel confident: “I can conduct business on Coinbase, make transactions, save for my future, and Coinbase has not given over my information.” My team cares deeply about privacy and protecting it. The Transparency Report is one way for customers to see what we do daily with law enforcement.

TOM TARANIUK: Absolutely. Trust matters, and privacy matters. For many, converting hard-earned money into a currency you can’t see or hold feels risky. So, John, what’s the most common fear or misunderstanding you encounter from people who don’t yet trust crypto?

The most common fear among people who don’t yet trust crypto

JOHN KOTHANEK: One common misconception is that crypto is anonymous and only used for criminal activity. In reality, a very small percentage of crypto volume is linked to crime. We’re doing better than fiat in some ways.

Another concern is that people fear making a mistake with crypto is terminal. Customers need to slow down and ensure accuracy. For example, I’ve seen people lose significant money when they auto-fill part of an address and send funds to the wrong address.

The ability to track crypto on the blockchain ensures it’s not truly anonymous. We often know who is at the end of a transaction because they eventually need to cash out through an exchange or a money mule. We can track that down.

Also, think of crypto like your bank transactions being fully transparent and unchangeable from your first to your last transaction. That visibility is powerful. Blockchain doesn’t change; it stays forever. It’s a fundamental tool for protecting customers.

TOM TARANIUK: One hundred percent. The immutable factor gives users comfort, especially with KYC at the off-ramp for turning digital currency back into fiat. Timeliness is important too. When it comes to scammers, thinking they can get away quickly might be a tool at their disposal. Another question: what do you make of the 18% decline in law enforcement requests over the last year? Is it positive, negative, or something else?

JOHN KOTHANEK: A few factors. First, law enforcement can now be more targeted thanks to analysis tools and blockchain tracking. Instead of querying multiple suspicious addresses, they can focus on the relevant ones. Second, budget and political factors can slow the process. Ultimately, law enforcement is still coming after criminals.

What makes me happy is seeing public involvement—podcasts, social platforms, people tracking transactions—which helps protect others. That alone is more impactful than any transfer-of-wealth tool. Collaboration and public education combined make a huge difference.

TOM TARANIUK: Absolutely. Collaboration with law enforcement and educating the public, alongside tech firm communication on trends and vectors, ensures users feel secure and helps reduce fraud. Before we wrap up, John, what gives you optimism in the fight against crypto fraud?

Is there optimism in the fight against crypto fraud?

JOHN KOTHANEK: The biggest thing is that from the start in 2014, Coinbase founders wanted law enforcement and governments to see us as part of the solution. We go after the bad guys aggressively but responsibly. That approach increases trust in Coinbase and crypto overall. Other companies are hiring aggressive investigators who won’t rest until victims are made whole or at least partially restored.

I come from a working-class family, so protecting wealth mattered to us. That’s what we want for our customers. Seeing other companies take responsibility and work hard to protect customers gives me hope. And your podcast raises awareness, which makes me really happy about the work we’re doing.

TOM TARANIUK: I'm glad you envision the future in such a bright way, and I think you mentioned, of course, the marketing there. It's super important to get the message out to individuals—day-to-day folks, James, John, Mary, etc.—around the world. It’s crucial so they come forward about scams they’ve experienced and are educated on how to prevent them, because it all starts and stops with them at the end of the day. Protecting them is the goal for many companies, whether on the retail side or the tech side. We all need to collaborate as one unit.

But, John, to close things out today, we like to have a little fun and get to know our guests. This is five quick questions from Sumsub. No overthinking. John, are you ready?

Quick-fire round

JOHN KOTHANEK: Sure.

TOM TARANIUK: Excellent. If you could ban one risky online behavior, what would it be?

JOHN KOTHANEK: Just one? How about all of it? Can I ban all of it? No. I would say not having an account that’s properly password-protected. With 2FA and proper security measures, there are ways to ensure strong passwords. If you don’t use it, I’d like to see companies require it—to help people protect themselves.

TOM TARANIUK: 100%. Multi-factor authentication is crucial. And if you want to check whether you’ve been compromised in a data leak, that’s certainly the way to go. Question number two, John: have you ever been a victim of fraud yourself?

JOHN KOTHANEK: Yeah, actually I have. It came at the worst time. I had my phone bricked and my SIM swapped. I was out on my motorcycle, enjoying a beautiful ride, and it broke down in the middle of nowhere. I had a cell signal but couldn’t do anything because my provider noticed suspicious activity. Someone tried to buy a bunch of phones on my account since they’d swapped my SIM. It turned out someone working at that company gave information to their friends. Yeah, that was rough. It doesn’t feel good to be ripped off. I think we all know that.

TOM TARANIUK: Yeah. It hits you like literally a bus, doesn’t it? Question number three, John: what’s one thing about fraud prevention that the public completely underestimates?

JOHN KOTHANEK: I think it’s that people like my team exist, and law enforcement exists solely to go after these bad actors. We are trying our best, but because of the timeframes we mentioned earlier, it’s hard for people to understand or believe that we’re really doing something. They don’t see results in three days and think, “You guys don’t care.” But we are trying, and we are going after these people as strongly as we can.

When I first started 25 years ago, law enforcement agents were a bit like old-school pencil-and-paper types, and they weren’t great with tech. Now, the officers and detectives working these cases are brilliant, highly skilled, and dedicated. The public needs to realize that we are going after the bad guys.

TOM TARANIUK: Absolutely. And you’re clearly communicating that through your efforts. Fourth question, John: what type of fraud do you think will grow the fastest in the next five years?

JOHN KOTHANEK: AI and technological advancements. It’s getting better and more complex. Victims need to recognize that calls to action—whether it’s donating to a fake cause, paying a fake bill, or being threatened with deportation—are designed to pressure them into acting quickly. Playing on emotions has always been a tactic, but now AI allows fraudsters to scale it massively with bots.

TOM TARANIUK: Exactly. Playing on emotions is nothing new, but AI enables mass manipulation. My final question, John: if you could have any other career, what would it be?

JOHN KOTHANEK: Those really tall cranes that help build skyscrapers, like Principal Tower in London—I’d love to be a self-erecting crane operator. That would be perfect.

TOM TARANIUK: I’ve always wondered how those cranes get set up themselves, usually taller than the building itself.

JOHN KOTHANEK: They lift a section, add another section, and drop it down—it grows 20 feet taller. It’s amazing. I love it.

TOM TARANIUK: Amazing. It’s like a playset for adults, isn’t it?

Well, thank you so much, John, for joining us on this episode of What The Fraud? Incredible to discuss all the efforts Coinbase and yourself are putting into practice—not only educating customers but also taking action against those responsible for these crimes. Great to have you on board and love chatting with you.

JOHN KOTHANEK: Thank you. People have to start listening and doing the right thing for themselves.

TOM TARANIUK: If you’ve enjoyed today’s chat with John, make sure to hit follow wherever you get your podcasts. And if you can, leave us a review; we’d love to hear your thoughts. It also helps more people find the show and learn how to avoid the latest scams.

On the next episode of What The Fraud?, we dive into the rapidly evolving world of delivery services, uncovering the tricks, traps, and tactics used by fraudsters in this fast-moving industry.