Social-Media Giveaway Scam Impersonating Coinbase
Fake Coinbase accounts on X/Twitter, Instagram, and Facebook run giveaway campaigns that require victims to 'verify' their wallet address by connecting it to a malicious site or sending a small amount of crypto to 'confirm eligibility' — both of which result in fund theft.
Part of: Social Media Giveaway Impersonation Scam
Last reviewed: 8 June 2026
Coinbase's recognisable brand and large user base make it a frequent target for giveaway impersonation on social media. Criminals create profile accounts with Coinbase's logo, cover image, and near-identical usernames — sometimes using Unicode lookalike characters — and then run reply-spam campaigns under genuine Coinbase posts or paid social ads claiming that Coinbase is celebrating a milestone with a cryptocurrency giveaway.
The two most common harvesting mechanisms are: directing users to a wallet-connect page that requests a 'drain approval' from their connected wallet, and asking users to send a small amount of crypto to 'register' for the giveaway, promising a larger return. Neither mechanism ever results in any return payment.
The emotional driver is FOMO — the fear of missing out on a limited-time promotion. Attackers invest in fake engagement (bot accounts claiming to have received their giveaway payout) to manufacture social proof and lower victims' scepticism.
How this scam works on the Coinbase brand
Real Coinbase promotional campaigns are announced exclusively at coinbase.com/news and through Coinbase's own verified social accounts. Coinbase has no promotions that require sending cryptocurrency first or connecting a personal wallet to a third-party claim site.
The fake version: a reply to a genuine Coinbase tweet says 'We are distributing 10,000 BTC to celebrate our anniversary. Visit [link] to claim your share.' The link leads to a Coinbase-branded page with a wallet-connect button. Connecting a MetaMask or WalletConnect-compatible wallet to this site and approving the signature request grants the malicious contract permission to move tokens from the victim's wallet. In wallet-drainer terminology, this is sometimes called an 'ice phishing' attack — the victim approves what looks like a verification but is actually a token-transfer approval.
The second variant simply asks for a small sending amount — 'Send 0.01 ETH to register and receive 0.1 ETH back' — which is the classic advance-fee structure applied to crypto.
Common red flags
- A social-media account with Coinbase branding announces a giveaway requiring you to send crypto or connect your wallet to a third-party site
- The account was created recently, lacks the official platform 'verified' badge, or has a username with subtle spelling differences from Coinbase
- Replies and comments on the post are overwhelmingly positive, with many claiming to have already received funds — likely bots
- The linked claim site is not coinbase.com
- You are asked to approve a 'signature' or 'permission' in MetaMask or your wallet app
- Urgency framing: 'Only 2 hours remaining — limited to the first 1,000 participants'
How to protect yourself
- Never send cryptocurrency to participate in a giveaway, regardless of how credible the account looks
- Never connect your wallet to a site you reached via a social-media giveaway link
- Check for the official verified badge on social-media accounts claiming to represent Coinbase
- Verify any claimed promotion directly at coinbase.com/news before taking any action
- Use a separate 'burner' wallet with minimal funds for any wallet-connect interactions you cannot verify
- Revoke any token approvals you may have accidentally granted at revoke.cash or a similar approval manager
How to report it
- Report the impersonating account to the social-media platform using the in-platform reporting tool
- Report to Coinbase's security team at help.coinbase.com
- File a report with the FTC at reportfraud.ftc.gov
- Report to IC3.gov (US) or Action Fraud 0300 123 2040 (UK)
- If crypto was sent or a wallet was drained, report the malicious wallet address on chain-analysis reporting tools if available
Frequently asked questions
The account replying to a genuine Coinbase tweet looked official — how did it get there?
Scammers routinely reply to real, high-traffic Coinbase posts within seconds of them going live, hoping their comment gets seen by people scrolling the replies. Appearing under an authentic Coinbase post is not evidence the reply itself is authentic — check the account's own profile and verification status separately.
I sent a small amount of crypto to 'register' for a giveaway — what should I do now?
Treat that payment as lost, since cryptocurrency transactions can't be reversed, and don't send any further amount if someone contacts you afterward offering to 'recover' it for a fee — that's a common follow-up scam. Report the wallet address and move on without paying anything more.
How do I check if a social account claiming to be Coinbase is actually verified?
Look for the platform's own official verification badge on the account, then cross-reference it against links posted on coinbase.com or Coinbase's other confirmed profiles. A convincing profile picture and bio aren't enough on their own, since badges can also be faked in an image.
Does Coinbase run legitimate giveaways or promotions?
Coinbase runs educational earn campaigns and occasional trading promotions, but none of them require sending cryptocurrency first or connecting to a third-party wallet-claim site. Always verify at coinbase.com/news.
What is 'ice phishing' in the context of a giveaway scam?
Ice phishing is a technique where the victim is tricked into approving a token transfer to a malicious contract — it looks like a harmless verification but grants the attacker the right to move tokens from your wallet. Approvals of this kind should be scrutinised carefully before signing.
Can I reverse an accidental token approval?
Yes. Wallet approval managers such as revoke.cash allow you to see and revoke token approvals you have granted to smart contracts. Doing this promptly after a suspected ice-phishing interaction can prevent further drainage.