A Twin Cities man opened an email, realized his mistake and watched as more than $2 million was drained from his Bitcoin account in a phishing scam, according to a state investigation.

An investigator working with the state Bureau of Criminal Apprehension (BCA) financial crimes task force laid out the Anoka County man's reverse windfall in a search-warrant affidavit filed this week. It seeks to gather information from the prime suspect's social media account.

The filing said the task force investigator in recent weeks has been communicating with the suspected cryptocurrency thief, who possibly has ties to Nigeria.

As of Friday, there have been no arrests or charges in connection with the case, said Brooklyn Park police Inspector Matt Rabe. The suburban department's cyber unit supervisor, Sgt. Jake Tuzinski, is heading up this investigation.

Once the investigation is complete, the case will be sent to the U.S. Attorney's Office for consideration of charges, Rabe said. The Minnesota Star Tribune generally does not identify suspects before they are charged.

Tuzinski said Friday that everyone needs to "take a pause while reading these emails. Verify who the email is coming from. Check not just the name of the header such as 'From: Coinbase,' but also drop it down and look at the full email domain it is coming from."

According to the search warrant affidavit:

The man, identified only as J.S. in the filing, told Tuzinski in September 2024 that "he was on his phone when he received an email from what he thought was Coinbase support. J.S. said he kept all his digital assets, which included over 40 Bitcoin, on his Coinbase Wallet app."

J.S. continued that "after he clicked on a link contained within the email, he realized the email was not legitimately from Coinbase and suspected it was a phishing attack. J.S. then went to his Coinbase Wallet app and saw his digital assets were being moved out of his wallet."

The man estimated that the sum of his digital assets in various accounts totaled $2.4 million, nearly all of it in Bitcoin.

J.S. reached out to Coinbase in an effort to stem the fiscal bleeding. But Coinbase said its exchange — which helps users make transactions — and the Wallet app are "two different things, [and] they were unable to stop any transactions."

Tuzinski unearthed each suspicious transaction and "noted the movement of the Bitcoin was consistent with money laundering and obfuscation," the investigator wrote in the search-warrant affidavit.

The investigator said he then turned to cryptocurrency exchange giant Binance and identified the suspect "through Nigerian documents and a self portrait."

The suspect explained in an email the Bitcoin was given to him anonymously, but "I believe [him] to be more involved than just simply receiving an anonymous donation," Tuzinski wrote.

Bitcoin is a digital currency that is not tied to a bank or government and allows users to spend money anonymously. The coins are created by users who "mine" them by lending computing power to verify other users' transactions. They receive Bitcoins in exchange. The coins also can be bought and sold on exchanges with U.S. dollars and other currencies.

Bitcoins are basically lines of computer code that are digitally signed each time they travel from one owner to the next. Transactions can be made anonymously, making the currency popular with libertarians as well as tech enthusiasts, speculators — and criminals.

How to protect your crypto assets

The long-running con known as phishing is one of many scams plaguing U.S. consumers in an onslaught that can feel relentless, with criminals targeting individuals via mail, email, phone, text and social media.

Experts in protecting cryptocurrency offer numerous tips on protecting assets from theft. They include:

  • Never share a seed phrase or private key.
  • Always double check website URLs, and look for spelling errors.
  • Use official app stores to download wallets or extensions.
  • Enable two-factor authentication when available.
  • Bookmark official sites.

And likely at the top of the list of suggestions from J.S.:

  • Avoid clicking unknown links.

For more about cryptocurrency in general from the Federal Trade Commission and how to watch out for scams, click here. It's fine, really.

This report contains material from the Associated Press.