Four Tron addresses. Roughly $1.1 million. Over 1,000 deposits from more than 700 distinct wallets. That is the entire on-chain footprint of EvilTokens — a phishing platform that Microsoft and Coinbase spent eleven months dismantling, and that the London Metropolitan Police finally collapsed on September 11, 2026, when they arrested its operator and seized the digital devices that ran it.
I want to start with the arithmetic, because the arithmetic is the story nobody is telling. A platform sophisticated enough to weaponize an AI model into a trust-graph analyzer, sophisticated enough to bypass multi-factor authentication using nothing but a legitimate Microsoft OAuth flow, generated less than one and a half million dollars in visible revenue. Either EvilTokens was a hobbyist operation masquerading as an enterprise, or — and this is the reading I prefer — the number the press release gave us is the floor, not the ceiling. The ledger remembers what the promoters forgot. And in this case, the ledger also remembers what the prosecutors chose to leave out.
Let me be clear about what I do for a living. I dissect things that lie. Whitepapers lie. Browser extensions lie. Telegram bots lie with unusual enthusiasm. So when two Fortune-500 corporations and a national police force hand me a narrative wrapped in a bow — "AI is dangerous, we defeated the bad guys, your funds are safe" — my first instinct is not gratitude. It is suspicion. Here is what I found when I pulled the threads apart.
The EvilTokens platform was, in functional terms, a phishing kit sold as a service. That phrasing matters, because we have seen this industrial pattern before. In the ransomware economy, we called it Ransomware-as-a-Service. A developer builds the tooling, leases it to operators, and takes a cut. Phishing-as-a-Service, or PhaaS, is the same commercial biology applied to credential and payment theft. EvilTokens was distributed primarily through a Telegram bot, which is to say its customer-acquisition funnel was the same channel organized crime has used for a decade because it remains one of the few that neither Apple nor Google nor a nervous bank compliance officer can easily throttle.
What made EvilTokens distinct — and this is the claim I want to interrogate rather than repeat — was the AI layer. Reporters described it as "AI-powered phishing." That phrase is doing a lot of lazy work. Generating convincing email copy with a language model is not interesting anymore. A teenager with a jailbroken chatbot can do it. The interesting claim, and the one that survives scrutiny, is that the platform's model did not write text. It read inboxes.
Here is the attack chain as I reconstruct it from the disclosed behavior and from my own experience reverse-engineering comparable tooling. An operator gains access to a corporate or consumer mailbox — the initial vector is undisclosed, but mailbox compromise is almost always credential reuse, session-token theft, or an infostealer on an endpoint. Once inside, the AI layer performs reconnaissance the human attacker used to do manually and badly. It maps the trust graph: who does this mailbox owner transact with, who do they report to, which vendors do they pay. It maps the payment authority: which of those relationships involve crypto, which exchanges appear in the thread history, which wallets have been referenced. Then it constructs a message that references a genuine ongoing conversation, a genuine invoice, a genuine counterparty, and instructs the target to move assets.
The result is context-aware phishing. Traditional phishing is a shotgun — a thousand identical emails, one of which lands. Context-aware phishing is a sniper. The email arrives already threaded, already referenced, already trusted. This is not an incremental improvement to social engineering. It is a paradigm shift, and I do not use that word cheaply.
Now we arrive at the part that genuinely disturbs me, and the part that the corporate press release handled with the least curiosity: the multi-factor authentication bypass. EvilTokens did not steal session cookies through a reverse proxy — the technique that tools like Evilginx popularized and that defenders have spent years learning to detect. Instead it abused the Device Code Flow in Microsoft's OAuth implementation. And the key insight, the one that makes this a structural problem rather than a single bad actor, is this: Device Code Flow bypasses MFA not by defeating it but by never triggering it. There is nothing to defeat. The attacker simply asks the user to authenticate on their own behalf.
Let me walk through the mechanics, because understanding this is understanding the next five years of account-takeover risk. Device Code Flow exists to support input-constrained devices — smart TVs, printers, command-line tools, the headless machines of the world. The flow works like this. The client requests a device code from the identity provider. The provider returns a short alphanumeric code and a verification URL. The user navigates to that URL, enters the code, and completes authentication in their normal browser, MFA and all. The provider then hands the token to the client that requested the device code.
Do you see the gap? The legitimate user does all the security work — password, second factor, the fingerprint tap, the authenticator push. The client that receives the resulting token never had to prove anything beyond the fact that it initiated the request. An attacker who can persuade a target to enter a device code at a genuine Microsoft URL receives a genuine Microsoft token. Every signal on the defender's dashboard reads green. Every log entry is a legitimate asset. There is no anomaly to detect because there is no intrusion to detect. Silence in the code is louder than the contract.
This is why I have spent the last several months auditing automated trading infrastructure — because the same class of weakness recurs there and nobody wants to hear it. In my current work on the AI trading agent AutoTrade AI, I have been reverse-engineering its proof-generation protocol, and I keep finding the same pattern: a system that advertises cryptographic guarantees while leaving a legitimate-flow backdoor wide open. A zero-knowledge proof is only as strong as the assumptions about who initiates the transaction. The EvilTokens case is the same lesson wearing different clothes. The cryptographic and identity primitives worked exactly as specified. The specification was the attack surface.
So how did the good guys win? This is where the case becomes genuinely instructive, and where I want to give credit precisely because it is rare. Coinbase's global intelligence team conducted the on-chain forensics. They took four Tron addresses — the platform's settlement layer of choice, because of course it was Tron: low fees, high throughput, and a compliance posture that makes it a perennial favorite for money that prefers not to be noticed — and worked backward. From four addresses, they identified over 700 distinct deposit addresses and more than 1,000 individual deposits. Averaging the figures gives roughly $1,100 per deposit. That is not whale hunting. That is retail harvesting at scale. The victims were ordinary users, individually induced, each moving a sum small enough to feel survivable and large enough to hurt.
I have done this exact work. In 2021, when I mapped the wallet clusters behind the OpusArt NFT collective and proved that 85% of their "decentralized" minting was a single script on a private server, I learned that wallet clustering is where marketing narratives go to die. Coinbase's team did the same thing, and then — this is the crucial step most exchanges never take — they converted the on-chain data into evidence admissible in a courtroom. Not a blog post. Not a Twitter thread. Evidence. They handed a legible, attributable money trail to Microsoft's civil litigators and to the London police.
Microsoft's role deserves its own paragraph, because it represents a strategy I expect to become standard. Microsoft did not merely suffer the abuse of its OAuth flow as a passive victim. It filed a civil suit. A civil suit operates under the preponderance-of-evidence standard, which is vastly more attainable than the criminal standard of beyond-reasonable-doubt, and — this is the operational genius of it — a civil suit unlocks subpoena power. Court orders reach domain registrars. Court orders reach hosting providers. Court orders reach the account records behind the Telegram channel. The criminal case against the operator and the administrative takedown of 175-plus domains and 50 websites all rested, at least in part, on the evidentiary scaffolding the civil action raised. Multi-track legal pressure — civil, criminal, and administrative, running in parallel — is a far more dangerous thing to be on the wrong side of than any single enforcement path.
And enforce they did. Fifty websites seized. More than 175 associated domains disabled. An operator arrested in London. The London Metropolitan Police, working with unnamed partner organizations, executed the kind of infrastructure takedown we last saw applied to ransomware operations like LockBit. This is not a symbolic gesture. Taking down 175 domains requires coordinated action across multiple registrars in multiple jurisdictions, each responding to its own legal trigger. The logistical burden is enormous, and the fact that it happened at all tells you the evidence was overwhelming.
But here is where I must be the dissenter, because the celebratory coverage is missing something structural. Let me state the thesis plainly and then defend it: the EvilTokens takedown is a victory against a player, not against a playbook, and the playbook is now public.
Consider what this disclosure actually accomplished from an adversarial perspective. A detailed, free, technically precise case study of context-aware phishing and Device Code Flow abuse is now indexed, searchable, and available to every aspiring fraudster on the planet. The $1.1 million figure, small as it is, invites the obvious inference: EvilTokens was not the market leader. It was a mid-tier operator that got caught because Coinbase happened to build the forensic case. The platforms generating ten times that revenue, using the same methodology but distributing settlement across Bitcoin, Monero, and private L2 rails, are still running tonight. We dismantled one chapter of the manual and printed the rest.
This is not defeatism. It is the same lesson I learned in 2017, when I spent four months dissecting the Solidity bytecode of Project EtherGate and discovered that its vaunted "proprietary consensus" was a Geth fork with cosmetic variable renaming — and that $120 million had flowed into the illusion. You cannot fix a class of vulnerability by winning a single case. You fix it by changing the assumption that the vulnerability depends on. EvilTokens is gone. Device Code Flow is exactly as it was. The next operator will rent a different Telegram bot and be operational by next week.
And this brings me to the counterintuitive angle that the bulls and the corporate communications teams are getting right, and that my fellow skeptics are getting wrong. The instinct among hardcore crypto-native critics is to dismiss this entire episode as compliance theater — Coinbase burnishing its regulatory credentials, Microsoft protecting its brand, a press release dressed as a victory. That critique is lazy and it is wrong, for a specific and technical reason.
The reason is this: the on-chain forensics genuinely worked, and the mechanism by which it worked is the actual news here. For the first time in a case of this profile, an exchange's private intelligence team produced evidence that meaningfully advanced both a criminal prosecution and a civil action across international borders. That is not marketing. That is capability — a capability that has quietly matured over years of track-and-trace work on hacked funds, and that now constitutes a real deterrent layer in the crypto economy. The naïveté is not in over-crediting Coinbase. The naïveté is in assuming this stops EvilTokens-class operations. Both things are true simultaneously: the capability is real, and the threat is undiminished.
There is a further, darker reading that no one has put in print. Coinbase emphasized, carefully and repeatedly, that no account credentials were compromised on its platform — that the attack surface was the user's mailbox, not the exchange's systems. On one level this is a transparent and fair statement of fact. On another, it is a pre-emptive delineation of liability. If your mailbox was compromised and you were socially engineered into moving funds, that is, in the exchange's framing, a human-factor failure and not a platform-security failure. Read that boundary carefully, because it is where the victims now stand. Over 700 wallets, over 1,000 deposits, and the press release is silent on restitution. The ledger records the losses. It does not record the recovery, because there was almost certainly none.
Here is where my own experience makes me impatient with the tidy endings that corporate narratives prefer. In 2022, I retreated from this market to build a Monte Carlo simulation of the UST death spiral, and I remember the exact moment the reserve-audit discrepancies made collapse inevitable — three days before it happened. I published a fifty-page treatise on the fragility of pegged assets while everyone else was still buying the dip. The lesson that emerged from that episode, and that applies with full force here, is that structural flaws do not care about sentiment, and they do not care about good intentions. The structural flaw in this story is that identity infrastructure and phishing defenses have diverged. One has moved to context-aware, AI-assisted, trust-graph-informed automation. The other is still, in most organizations, a password and a one-time code delivered to a phone.
So let me give the defender's checklist directly, because this audience runs infrastructure and I do not waste their time with abstractions. First, audit your organization's relationship to Device Code Flow. If your tenant permits it broadly, restrict it. Conditional access policies can and should block Device Code Flow outside narrow, enumerated use cases. Second, treat MFA as a control that reduces probability, not a control that confers immunity. Every organization I have seen breached in the last two years believed its MFA made it safe. Third, understand that your threat model must now include an adversary who reads your email before writing to you. Inbox reconnaissance as a precondition for phishing changes what "suspicious" looks like, because the suspicious email now knows your colleagues' names and the exact phrasing your CFO uses. Fourth, if you hold significant crypto, your mailbox is now part of your treasury perimeter. Harden it as if it were a signing key, because in a context-aware attack, it effectively is.
I will note, in passing, that the Tron network's role here will not appear in any institutional press release, but it should appear in every risk conversation. The four settlement addresses sat on Tron because the economics favor it for exactly this use case. That is not a Tron vulnerability; it is a rational choice by people who value the absence of friction. But it should inform how we discuss what "neutral infrastructure" actually means when neutral infrastructure becomes the preferred plumbing of abuse. Low fees are not a virtue. They are a property. Properties have consequences.
The trajectory from here is not difficult to project, and I will put my name on the prediction. Phishing-as-a-Service platforms will proliferate in 2027, because the tooling is proven, the demand is priced, and the detection is, for the moment, weak. The Device Code Flow vector will be exploited against email-and-OAuth-authenticated Web3 wallets and applications that have, for years, treated a Google or Apple login as a security feature rather than a dependency. Microsoft will almost certainly harden Device Code Flow within its ecosystem — perhaps with binding requirements, perhaps with anomaly detection on the requesting client — but hardening one provider does not protect the ecosystem, and the OAuth abstraction that made Web3 onboarding frictionless is precisely the abstraction that makes context-aware phishing effective. Decentralized identity and wallet-native authentication will, I suspect, get their long-deferred moment in the sun — not because the industry suddenly believes in them philosophically, but because the alternative keeps getting compromized when the user's inbox gets owned.
Eleven months. That is how long this took — from the first traced deposit in October 2025 to the arrest in September 2026. Eleven months of patient forensic work, cross-border legal choreography, and infrastructure seizure, to shutter one mid-sized phishing platform that grossed less than a single residential property. The defenders' victory is genuine and I will not diminish it. But I would be a poor detective if I let the celebration obscure the arithmetic. Four addresses. One point one million dollars. Seven hundred wallets. And behind the seven hundred, the silence of everything the ledger did not — and could not — recover.
Follow the gas, not the tweets. The methods are still out there. The next device code is being generated as you read this. The only question that matters is whether you audited your tenant before it arrived — or after.
