Four Tron addresses. That was the entire financial spine of the phishing operation that Microsoft and Coinbase just spent months pulling apart.
Not forty. Not four hundred. Four.
Across roughly ten months, those four wallets absorbed more than a thousand deposits from at least seven hundred distinct source addresses. Total haul: about $1.1 million. The arithmetic writes itself โ an average ticket near $1,100, high frequency, low value, the precise signature of a subscription business.
That is what EvilTokens actually was. Not a hack. A service. And those seven-hundred-plus sending addresses are not the victims. They are the tenants.
I take flows apart the same way every time. Skip the announcement, read the ledger. What the press release branded an "AI-powered criminal enterprise" looks, on-chain, like a mid-sized B2B software company with an appalling product roadmap. Once you see it as software-as-a-service, the takedown stops looking like a victory and starts looking like a churn event.
Context
Here is what happened, stripped of the marketing.
EvilTokens ran as phishing-as-a-service. PhaaS, in the trade. You rent the kit; you do not build it. Distribution went through a Telegram bot. Subscribe, receive tooling, launch campaigns. The operator never needed to meet a customer, never needed to write an exploit. That is the whole point of PhaaS: it converts a technical skill into a purchased commodity, exactly the way Evilginx converted credential harvesting years ago. Novelty score, low. Efficiency score, high.
The mechanism matters more than the brand. Three pieces, stacked.
First, AI analysis of compromised inboxes. The kit sorted targets by trust relationships and payment authority. Not spam โ triage. Who can wire money, who trusts whom, who is one reply away from approving a transfer. That is prioritization, not automation.
Second, the Microsoft Device Code Flow. OAuth 2.0's answer to devices without a browser. Smart televisions, IoT boxes, anything where you punch a code on one screen and approve on another. The attacker induces the victim to enter a legitimate code into the attacker's session. Token stolen. MFA bypassed without ever being cracked. This is not a new weapon. Microsoft's own security teams have published on device code phishing for years. It is a known weakness being mass-retailed.
Third, the quiet collapse of the MFA assumption. Everyone treats multi-factor authentication as a moat. It is a moat with a service door, and the door was built on purpose, for usability.
Coinbase's intelligence team traced the money. Four Tron addresses. More than a thousand deposits. Seven hundred-plus source addresses. Enough to thread a civil case through. The United Kingdom's Metropolitan Police arrested an operator. Fifty websites seized, 175-plus domains disabled. Microsoft pushed civil litigation. Coinbase supplied the on-chain evidence.
One thing the coverage did not handle well: the timeline. One disclosure had the revenue window running from October 2025 to June 2026. Another put the arrest on September 11. If the arrest was September 11, 2025, it predates the revenue window โ impossible. If it was September 11, 2026, then the "current" framing of the Coinbase disclosure needs checking against the actual publication date. When a narrative rests on specific figures, the clock has to hold. It does not here.
Core
Three weeks into a similar trace โ a Curve stablecoin flow study back in 2020, before Tron became the default laundering strip โ I learned a rule I still use. If you want to know what a business is, count its payers, not its victims. Payers are voluntary. Payers reveal the model.
Seven hundred payers. Sit on that for a second.
A subscription operation with over seven hundred distinct funding addresses is not a lone operator with a grudge. It is a marketplace with distribution. Each address maps to a tenant โ someone who rented the tool, ran campaigns, and paid the platform its cut. Some of those addresses are almost certainly resellers, downstream distributors who bought wholesale and sold access retail. That is standard PhaaS architecture: platform, agents, end users. Three layers, one Telegram bot on top.
I built a scraping bot in 2021 to cluster wallets across a thousand high-value BAYC transactions. It found that roughly forty percent of recorded sales traced back to a single entity running a dozen interconnected wallets. Same technique here, different target. When seven hundred funding addresses feed four collection wallets, you are not looking at chaos. You are looking at a customer base.
The revenue number is what everyone misreads. Commentators looked at $1.1 million and shrugged โ small change in crypto. They are looking at the wrong line item. That $1.1 million is the platform's income, not the victims' losses. The platform's cut. The tenants who paid it kept their own proceeds, and their campaigns ran against their own target lists.
If a PhaaS platform nets $1.1 million, the gross haul across its tenant base is typically one to two orders of magnitude larger. The kit earns a slice; the tenants earn the meal. Which means the actual damage tied to EvilTokens is not $1.1 million. It is somewhere in the tens of millions, and nobody has published it, because nobody can. Tenant campaigns do not reconcile to a shared ledger.
That gap โ platform revenue versus ecosystem loss โ is the most misreported number in every phishing takedown story. And here is the deeper problem. The trace only captured four addresses. Operators do not aggregate all their money into four wallets unless they are done. Four is what was found. Assume undercount. The wallet history tells the real story โ but only the wallet history that was seized.
Now the settlement chain. Tron was not a random choice.
Tron's throughput and near-zero fees made it the default rail for stablecoin transfers some time ago, and USDT on Tron is now the grey-market currency of first resort. Low cost, high speed, enormous liquidity. For someone moving eleven-hundred-dollar tickets a thousand times, fees matter. Ethereum mainnet at the wrong hour eats your margins. Tron does not.
So when I see four Tron addresses collecting subscription payments, I do not need a press release to tell me the settlement asset. It is USDT. Confidence high. And I do not need a threat report to tell me those USDT are gone โ swapped, layered, partially bridged, spread across the exchange surface within days of receipt. Tracing can tag them. Tagging is not recovering.
Here is what the takedown actually bought.
Fifty websites seized. 175-plus domains disabled. One operator arrested. That is a node removal. PhaaS infrastructure is modular by design โ the bot, the templates, the hosting, the AI analysis layer are separable components that recombine. Kill the operator, and the tenants migrate to a rerun. The economics of the replacement are trivial: a new Telegram bot, a handful of rented domains, done. The seized domains are dust. The workflow is the asset.
The people who built PhaaS understood that enforcement targets individuals, not architectures. So they built something individuals can be abstracted out of. That is the actual innovation here, and it is commercial, not technical. The headline says "AI-powered." The attack chain says OAuth documentation. Both are true. Only one is newsworthy, and it is not the OAuth part.
That distinction matters for defenders. If you believe the threat is an AI-powered adversary, your response is to fight AI with AI โ expensive, slow, and usually a procurement exercise. If you understand the threat is a two-decade-old authorization flow being mass-marketed by a rented toolkit, your response is to lock down the flow. Disable uncontrolled device code logins. Restrict token issuance. Treat any "enter this code to verify" prompt as hostile by default. The second response is cheaper and actually works. Based on my audit experience, the exploitable surface is almost never the layer the marketing points at. It is the layer everyone agreed to compromise on for convenience.
And then the Coinbase statement, which deserves the forensic treatment.
Coinbase said accounts and credentials were not leaked. Coinbase also said some customers were induced to transfer funds to scam addresses. Read those two sentences together. They are not contradictory in a legal sense โ a user voluntarily sending money is not a breach. But they are contradictory in the sense that matters to the person who lost the money. Account security and user fund security are separate variables, and the statement keeps them apart on purpose. That is not deception. It is liability architecture, drawn in advance. The distribution of who eats the loss โ the user, the exchange, or nobody โ is being settled in that sentence. I read it as a litigator's sentence, not a protection sentence. Confidence moderate.
The competition structure explains the whole event's shape. Coinbase held first-party data โ the deposit addresses touching its customers. Microsoft held the account-side view โ device code abuse inside its own identity system. The Metropolitan Police held coercion. Analytical tooling sat underneath. Nobody in that coalition could have done it alone. It is a public-private loop, and it is the most important thing this story actually produced. It is also replicable. Which cuts both ways. Good enforcement can scale. So can the replacement.
Contrarian
Everyone is calling this a deterrent. I will call it what the ledger calls it: a churn event.
Here is the correlation trap. Coverage will link the takedown to a decline in phishing. There is no causal chain there. Phishing volume is driven by target availability and tool cost, not by how many operators are in prison. Remove one node, and resupply is immediate. The 175 disabled domains will be replaced faster than they were registered. If you plotted PhaaS availability against enforcement actions over the last five years, you would not see suppression. You would see a floor.
Floor prices do not move on fundamentals either โ they move on whatever the loudest wallet did that week. Same mechanic here. The market for criminal tooling does not clear on enforcement. It clears on demand.
The second trap: "AI-powered." That label does double duty. For the criminals, it attracted tenants. For the defenders, it attracted budget. Both sides benefit from the word. The underlying exploit is old. Treat AI as packaging, not physics.
The third: the recovery narrative. It will not happen. The USDT left Tron. Tagging is not seizure. The twenty percent recovery ceiling I use for crypto crime is generous on this one.
Takeaway
Watch the next thirty days for one signal, not the headlines: whether a replacement PhaaS bot appears on Telegram with the same device code workflow. If it does โ and it will โ this was a churn, not a cure.
Then watch your own authentication stack. The yield did not protect anyone here, and neither did MFA. What protects you is disabling the flow that was weaponized, before someone rents the tool that uses it.