{"id":23227,"date":"2026-03-05T06:40:42","date_gmt":"2026-03-05T06:40:42","guid":{"rendered":"https:\/\/bitunikey.com\/news\/coinbase-microsoft-and-europol-dismantle-tycoon-2fa-phishing-network\/"},"modified":"2026-03-05T06:40:49","modified_gmt":"2026-03-05T06:40:49","slug":"coinbase-microsoft-and-europol-dismantle-tycoon-2fa-phishing-network","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/coinbase-microsoft-and-europol-dismantle-tycoon-2fa-phishing-network\/","title":{"rendered":"Coinbase, Microsoft and Europol dismantle Tycoon 2FA phishing network"},"content":{"rendered":"<p><\/p>\n<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">Crypto exchange Coinbase teamed up with Microsoft and Europol to take down phishing-as-a-service platform Tycoon 2FA.<\/p>\n<div id=\"cn-block-summary-block_4bfcfc2e4eaa1e2962cb2fe4d3ea4195\" class=\"cn-block-summary\">\n<div class=\"cn-block-summary__nav tabs\">\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/div>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>Coinbase helped trace blockchain transactions linked to the Tycoon 2FA phishing network, allowing investigators to identify the platform\u2019s alleged administrator and several users of the service.<\/li>\n<li>Tycoon 2FA offered a subscription toolkit that enabled criminals to intercept authentication sessions and bypass multi-factor protections.<\/li>\n<li>Phishing losses dropped nearly 83% in 2025.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>In a Wednesday <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.coinbase.com\/en-au\/blog\/coinbase-and-microsoft-disrupt-tycoon-2fa\" target=\"_blank\" rel=\"nofollow\">announcement<\/a>, Coinbase said that it helped trace blockchain-based transactions linked to the platform, and as a result, law enforcement was able to identify the phishing operation\u2019s alleged administrator and several of its customers.<\/p>\n<p>According to Europol, Tycoon 2FA sold a subscription-based toolkit that helped bad actors intercept live authentication sessions and gain unauthorised access to online accounts, \u201cincluding those protected by additional security layers.\u201d<\/p>\n<p>Using Tycoon\u2019s phishing toolkit, cybercriminals were able to capture session cookies from authenticated users and therefore access accounts without triggering the multi-factor authentication prompts, Coinbase said.<\/p>\n<p>\u201cWe\u2019re actively working to identify Tycoon purchasers and will continue supporting law enforcement efforts focused on the people who bought and used this service to target victims,\u201d it added.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<p>The platform has been active since at least 2023, and by mid-2025, Tycoon 2FA accounted for nearly 62% of all phishing attacks blocked by Microsoft, Europol <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/global-phishing-service-platform-taken-down-in-coordinated-public-private-action\" target=\"_blank\" rel=\"nofollow\">said<\/a>.<\/p>\n<p>\u201cAt scale, the platform generated tens of millions of phishing emails each month and facilitated unauthorised access to nearly 100,000 organisations globally, including schools, hospitals, and public institutions,\u201d it added.<\/p>\n<h1 class=\"wp-block-heading\">Phishing attacks continue to threaten crypto users<\/h1>\n<p>As previously reported by crypto.news, losses from phishing attacks dropped 83% in 2025 when compared to the previous year. Nevertheless, attackers have continued to use more advanced techniques, including exploits tied to EIP-7702, Permit and Permit2 signatures, and transfer-based attacks.<\/p>\n<p>A separate report from blockchain security firm CertiK flagged that Phishing attacks remained the third most costly attack vector in 2025.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Crypto exchange Coinbase teamed up with Microsoft and Europol to take down phishing-as-a-service platform Tycoon 2FA. Summary Coinbase helped trace blockchain transactions linked to the Tycoon 2FA phishing network, allowing&hellip;<\/p>\n","protected":false},"author":1,"featured_media":23228,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-23227","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/23227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=23227"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/23227\/revisions"}],"predecessor-version":[{"id":23229,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/23227\/revisions\/23229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/23228"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=23227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=23227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=23227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}