Coinbase, Microsoft and Europol dismantle Tycoon 2FA phishing‑as‑a‑service infrastructure

On Wednesday, Europol said a coalition including Coinbase and Microsoft dismantled key infrastructure of Tycoon 2FA, a phishing‑as‑a‑service platform used to bypass multi‑factor authentication. By mid‑2025, Tycoon 2FA represented 62% of phishing attempts blocked by Microsoft, with more than 30 million malicious emails in a single month, and Coinbase traced blockchain transactions linked to the alleged operator and customers.