The SlowMist security team recently detected a risky behavior that was suspected to be masquerading as an official Coinbase address (0xcd53b841ffa2afba778d03ef928cfe864accca7b). The address tried to send a fake message to users who withdrew large assets from Coinbase Prime through an on-chain shout. The content of the shout falsely stated that "due to an operation error during the transaction process, users need to refund all funds transferred through ETH by mistake, otherwise law enforcement will be contacted". We recommend that all users be vigilant of such phishing behavior and verify the transfer information as much as possible before executing the transfer operation to avoid unnecessary asset loss.