{"success":true,"data":{"id":"crypto-exchange-credential-harvest-phish","label":"Fake Coinbase/Binance/Kraken account suspension or KYC notice with credential-harvest login link — targets hot wallet/exchange credentials (distinct from hardware wallet seed phrase phishing).","description":"Fake Coinbase, Binance, Kraken, or similar crypto exchange claiming an account has been suspended due to unusual activity or KYC requirements, with a credential-harvest login CTA — exchange account takeover targeting hot wallet/exchange balances. Distinct from the hardware-wallet seed-phrase phish (batch 8) which targets cold storage. Attackers steal exchange credentials to liquidate balances, change withdrawal addresses, or enable OTC fraud. Detection: Coinbase/Binance/Kraken/crypto exchange + account suspended/KYC required + click to verify/log in to verify action + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R22; Chainalysis exchange phishing 2025; APWG crypto exchange impersonation advisory.","tier":"danger","category":"phishing","isThin":false}}