Coinbase and Microsoft help dismantle Tycoon 2FA phishing network

Traders Union
All News
Crypto News
Coinbase aids Europol probe

International operation against Tycoon 2FA

According to Europol, Tycoon 2FA operated as a “phishing-as-a-service” platform. The service sold subscriptions to tools designed to steal user credentials, allowing even individuals with limited technical skills to launch phishing campaigns.

Microsoft helped block 330 domains linked to Tycoon’s infrastructure, including phishing pages and administrative panels. At the same time, law enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain and the United Kingdom seized servers and other elements of the network.

The investigation was coordinated by Europol’s European Cybercrime Centre (EC3). Cloudflare, Trend Micro, Proofpoint and other companies also participated in the operation.

The platform had been active since at least August 2023. According to Microsoft, by mid-2025 Tycoon was linked to roughly 62% of all phishing attacks the company blocked in its systems. In a single month alone, the service was used to send more than 30 million malicious emails.

Tycoon’s tools created convincing copies of popular websites and intercepted session tokens and cookies. This allowed attackers to bypass multi-factor authentication and gain access to corporate email accounts, cloud services and other online systems.

Coinbase helped trace cryptocurrency payments

Crypto exchange Coinbase also played a role in the investigation. The company helped analyze blockchain transactions used to finance the platform.

“Platforms that offer phishing services operate like illegal software businesses: subscriptions, resellers, support and recurring revenue. Some of these payments are made through cryptocurrency, and blockchain transactions create investigative leads that can help link operators, buyers and the associated infrastructure,” company representatives said.

Analysis of those payments helped investigators identify the platform’s alleged administrator. According to the investigation, he may be Pakistani national Saad Fredi.

Coinbase also stressed the importance of cutting off the financial channels behind such services:

“When criminals can no longer receive payments and keep their infrastructure running, their ‘business model’ collapses.”

Why the takedown matters

Phishing attacks remain one of the biggest threats to crypto platforms and online services. According to CertiK, phishing led to losses of about $722 million across 248 incidents in 2025.

Such platforms lower the barrier to entry for cybercriminals. They sell ready-to-use attack tools, technical support and updates, effectively turning cybercrime into a service-based industry.

At the same time, joint operations by the private sector and law enforcement are beginning to show results. According to cybersecurity firm SlowMist, the amount stolen through phishing attacks in 2025 fell 83% to $83.85 million.

The Tycoon 2FA case highlights the growing role of cooperation between technology companies, crypto exchanges and law enforcement agencies in tackling cybercrime. Blockchain analysis and cross-border intelligence sharing are becoming key tools in such investigations.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.