UK police arrested operators of a Telegram-based fraud operation on September 11, 2026, following a joint investigation by Coinbase, Microsoft, Cloudflare, and TRM Labs. The platform, known as EvilTokens, provided phishing-as-a-service for business email compromise scams through automated email harvesting and target selection. The coordinated effort seized 50 websites and more than 175 domains to permanently disrupt the service.

The investigation traced $1.1 million in revenue on the Tron blockchain linked to the AI-powered platform. Coinbase reported that no user accounts were compromised during the operation. The takedown illustrates how artificial intelligence lowers barriers for fraud and the role of digital assets in funding cybercrime infrastructure.