Coinbase impersonator sentenced to four to 12 years over $16 million theft

Ronald Spektor, a Brooklyn resident who impersonated Coinbase staff to steal cryptocurrency from about 100 users, was sentenced on September 23 to four to 12 years in prison. The Brooklyn District Attorney's Office announced the sentence after Spektor pleaded guilty to all 31 counts of an indictment involving nearly $16 million in losses.

Brooklyn Supreme Court Justice Danny Chun imposed the term on Spektor, 23, of Sheepshead Bay. His September 2 plea covered charges including first-degree money laundering, first-degree grand larceny and first-degree criminal possession of stolen property. Prosecutors had opposed the promised sentence and sought seven to 21 years, a difference also documented in Unchained's report on the hearing.

The court ordered almost $16 million in restitution and forfeiture of cash, cryptocurrency and personal property estimated at more than $500,000. Those are separate parts of the sentence. The announcement does not say that victims have received full repayment, and the value identified for forfeiture is substantially below the reported losses.

The transfers victims believed would protect their funds

The scheme depended on persuading users that a hacker threatened their holdings. Spektor posed as a Coinbase representative and directed them to move assets into a new wallet. Victims believed they alone controlled it, but Spektor could access the wallet and drain it, according to the sentencing announcement.

The office's Virtual Currency Unit put the approximate losses at $15,944,000 after a yearlong investigation. Victims were spread across the United States; some lost $1 million or more. CoinDesk's September 24 coverage likewise describes an impersonation and social-engineering scheme in which users were persuaded to transfer their own holdings.

An earlier December 2025 charging announcement gives a more detailed account of the approach. A Pennsylvania victim described receiving a September 2024 call from someone claiming to be Coinbase security employee "Fred Wilson." Spoofed two-factor authentication messages from Coinbase and Google arrived immediately beforehand, helping convince the victim that account credentials had been compromised. Prosecutors said that person lost approximately $53,150 in cryptocurrency.

A Maryland victim described calls and emails warning that her wallet was compromised. About $38,750 in cryptocurrency was then transferred from a wallet she believed she controlled, the same charging notice said. These accounts describe how the false security warning preceded the transfer; they do not establish that Coinbase's exchange infrastructure was breached in this case.

The evidence and the recovery orders

Investigators followed assets through swaps across cryptocurrency exchanges, mixing services, gambling services and online storefronts. Prosecutors said the funds eventually reached points where they could be converted, wagered, withdrawn as cash or spent on gift cards and other digital assets. Their evidence included transaction records, blockchain analysis, digital forensics and material obtained through search warrants.

The DA's account also links Spektor's home IP address to multiple drained wallets. Recovered messages showed him discussing losses of $6 million through cryptocurrency gambling, prosecutors said. That figure describes statements found by investigators, rather than a separate accounting of money recovered for victims.

Prosecutors described online recruitment as another part of the operation. They said Spektor used forums to recruit people to act as social engineers and ran a Telegram channel called "Blockchain enemies" under the handle @lolimfeelingevil. Messages recovered from his phone also indicated that, after online fraud allegations surfaced, he disposed of a cryptocurrency hardware wallet and bought a replacement. The sentencing notice presents those communications alongside the transaction and forensic evidence used to identify him.

Coinbase assisted the investigation. In the original charging release, chief legal officer Paul Grewal said the exchange helped identify the perpetrator and affected customers, supplied evidence and assisted efforts to trace and recover funds. At that stage, the office reported seizures of about $105,000 in cash and approximately $400,000 in cryptocurrency.

The September sentencing notice describes forfeitable assets worth more than half a million dollars and a restitution obligation covering almost $16 million. It provides no schedule for distributing recovered assets or completing restitution payments.