Coinbase and Microsoft have jointly dismantled a major cybercrime operation known as “EvilTokens,” a coordinated network of malicious smart contracts designed to steal user funds across multiple blockchains.
The takedown marks one of the most significant cross‑industry security interventions in the digital‑asset sector, demonstrating how exchanges, cybersecurity firms, and technology companies are increasingly collaborating to neutralize threats that exploit decentralized infrastructure.
The operation opens up a new era in crypto security—one where proactive intelligence, rapid response, and multi‑stakeholder coordination are essential to protecting users and stabilizing market trust.
Details of the Joint Operation
Coinbase’s threat‑intelligence team and Microsoft’s cybersecurity division jointly identified and dismantled a sophisticated criminal network responsible for deploying malicious smart contracts disguised as legitimate tokens.
These “EvilTokens” were engineered to drain user wallets, manipulate token approvals, and exploit vulnerabilities in decentralized applications. The operation involved tracing on‑chain activity, analyzing malicious contract patterns, and coordinating with blockchain networks to disable or blacklist the affected contracts.
Media reports note that the takedown, moved forward under a US District Order, was not limited to removing malicious tokens.
Coinbase and Microsoft also disrupted the infrastructure supporting the cybercrime network, including command‑and‑control servers, distribution channels, and automated deployment systems used to propagate new malicious contracts.
The collaboration leveraged Microsoft’s threat‑intelligence capabilities and Coinbase’s on‑chain analytics to identify the actors behind the operation and prevent further attacks.
EvilTokens’ Crime Network
The EvilTokens network functioned as a coordinated cybercrime system that mass‑produced malicious smart contracts disguised as legitimate tokens. These contracts embedded hidden drain functions, allowing attackers to seize wallet permissions and siphon user funds once victims interacted with them.
The group used automated deployment pipelines, rotating wallets, and obfuscation techniques to launch thousands of variants across multiple chains.
EvilTokens’ infrastructure included command‑and‑control servers that pushed updates and redistributed new malicious contracts, enabling continuous propagation and evasion.
Coinbase and Microsoft traced these patterns to dismantle the network and shut down its supporting infrastructure.
Crypto Security on Crossroads
The dismantling of EvilTokens is significant because it reflects a shift in how the industry responds to cyber threats.
Historically, crypto security has been reactive, with platforms addressing vulnerabilities only after users suffer losses. The Coinbase–Microsoft operation represents a proactive approach, where threats are identified and neutralized before they cause widespread damage.
Malicious smart contracts pose a unique risk because they exploit the trust users place in decentralized applications. Once deployed, these contracts can operate autonomously, draining funds without requiring further human intervention. Removing them requires deep technical expertise and coordinated action across multiple networks.
The takedown demonstrates that exchanges and technology companies can play a critical role in securing decentralized ecosystems.
Coinbase’s on‑chain intelligence and Microsoft’s cybersecurity infrastructure provided complementary capabilities that neither entity could deploy alone. This collaboration sets a precedent for future cross‑industry security operations.
Moreover, the operation reinforces the importance of user protection in the digital‑asset sector.
As crypto adoption grows, cybercriminals are increasingly targeting retail users who may not have the technical expertise to identify malicious contracts. Proactive interventions help maintain trust in the ecosystem and reduce the risk of large‑scale financial losses.
The takedown also emphasizes the need for continuous monitoring of smart‑contract ecosystems.
Malicious actors are becoming more sophisticated, using automation and obfuscation techniques to deploy harmful contracts at scale. Industry‑wide vigilance is essential to staying ahead of these threats.