Security Current Affairs

Brooklyn Lad Gets 12 Years for $16M Coinbase Phishing Spree

2026-09-24

Ronald Spektor was 23 when Brooklyn Supreme Court Justice Danny Chun sentenced him to four to 12 years in prison on September 23. The charge? Running one of the more brazen phishing operations ever aimed at Coinbase's customer base. He'd pleaded guilty to all 31 counts just weeks earlier.

The mechanics were almost mundane in their simplicity. Spektor impersonated Coinbase support, rang up roughly 100 victims across the US, and told them their accounts were being hacked. Terrified, they did what he suggested: move funds to new wallets. Secure wallets, he promised. What he didn't mention was that he controlled those wallets. He drained them dry the moment the crypto landed.

Over a year, this netted him nearly $16 million. Some victims lost over $1 million each.

Then came the laundering. Spektor wasn't sloppy about it. He swapped coins across exchanges, pushed them through gambling sites, converted between different cryptocurrencies, and cycled proceeds through cash-out points before buying gift cards or piling back into digital assets. It's the kind of methodical obfuscation that usually takes experience. Spektor was 23.

Law enforcement cracked him via digital forensics and blockchain analysis. His home IP connected directly to wallets receiving stolen funds. They found messages under his handle @lolimfeelingevil, a Telegram channel called "Blockchain enemies," and Discord chats where he bragged about the whole thing. The Discord logs showed he'd gambled away about $6 million of his own take. Yet he kept claiming he'd earned millions scamming.

When fraud allegations started circulating online, he torched a hardware wallet and bought a replacement. Text messages on his phone captured it all.

The Brooklyn District Attorney's Office hit him with first-degree money laundering, first-degree grand larceny, first-degree criminal possession of stolen property, and others. The plea deal promised a sentence; the DA's office wanted seven to 21 years and objected to the agreement. Spektor got four to 12.

Forfeit orders: over $500,000 in cash, cryptocurrency, and personal property. Restitution: nearly $16 million to victims. Investigators seized roughly $105,000 in cash and $400,000 in crypto at arrest. Millions more just vanished.

Coinbase helped throughout—identifying victims, tracing funds, gathering evidence. They knew what to do.

The case sits at the intersection of a familiar warning and a real threat. Brooklyn DA Eric Gonzalez noted that legitimate companies never cold-call customers asking them to move funds to "safe wallets." Spoofing works. Caller ID lies. Sender names lie. Domain names lie. Most people don't know that.

This is what happens when social engineering meets someone with enough technical knowledge to not bungle the follow-up.

Source & further reading:

Sources