Coinbase Impersonator Who Stole $15.9M Gets Four to 12 Years

A Brooklyn court sentenced Ronald Spektor to four to 12 years in prison on Wednesday over a scheme that took $15,944,000 from about 100 Coinbase users in the United States. He posed as a representative of the exchange, told holders their assets were exposed to hackers, and talked them into moving coins to wallets they believed were their own. Spektor, 23, of Sheepshead Bay, pleaded guilty on 2 September to the entire 31-count indictment. Justice Danny Chun of Brooklyn Supreme Court gave him the term his plea promised.

The sentence the prosecution did not want

The district attorney's office had asked for seven to 21 years. Its release states that the plea was taken "in exchange for the promised sentence over the objection of the District Attorney's office," and The Block, Decrypt and hoodline all report the rejected range the same way. The counts he admitted are first-degree money laundering, first-degree grand larceny and first-degree criminal possession of stolen property. Restitution was set at almost $16 million. He also forfeits cash, cryptocurrency and personal property the office values at more than half a million dollars.

Whether the restitution is collectible goes unaddressed in every account. About $105,000 in cash and $400,000 in crypto were seized at his arrest, figures that appeared in the December 2025 indictment coverage and again this week. Decrypt reports that roughly $6 million of the proceeds went on gambling and that millions are still missing. It stands alone on both.

A phone call did the work

Nothing was broken into. The method was a call and a plausible script: the account is under attack, move the funds somewhere safe, here is the address. The district attorney's office describes the money then being laundered through exchanges, gambling services and online storefronts. The Block adds conversion to cash, bets and gift cards, while the account of the December 2025 indictment mentions mixers and swapping services that this week's material does not repeat. Each version of the route is slightly different and none of them is complete.

Some victims lost $1 million or more. Investigators interviewed more than 70 of them, and Decrypt reports twelve wallets recovered from his phone tied to over 140 deposits from about 90 people. Decrypt also has him running a Telegram channel under the handle @lolimfeelingevil, boasting about the thefts and recruiting help; the press release does not mention it. What the scheme borrowed was trust in a support channel, the same asset abused when phishing emails reached Trezor users from Trezor's own domain.

Named by a stranger a year before the charges

ZachXBT, the independent blockchain investigator, published a thread naming Spektor in November 2024 after a victim came to him for help. The indictment followed in December 2025. Coinbase worked with the office's Virtual Currency Unit on identifying him and tracing the money, according to The Block's report on that indictment; no statement from the exchange appears in this week's coverage. Investigators tied the internet address at his home to wallets that received stolen coins.

"This case should put crypto scammers on notice: we will follow the digital trail wherever it leads and aggressively pursue those responsible," the district attorney's office said.

Where this sits in the loss numbers

Deception now costs holders more than defective code does. Chainalysis put 2025 scam losses at $17 billion in its crime report published on 14 January, with impersonation scams up 1,400% on the year. Protocol failures are the smaller and better-documented half, as this desk's reading of stolen keys against code bugs found in August.

Two threads are left hanging. Prosecutors in December 2025 called Spektor's father an active suspect, and nothing published this week says whether he was ever charged. We could not establish whether anyone recruited through the Telegram channel faces proceedings of their own.