A Twin Cities man opened an email, realized his mistake and watched as more than $2 million was drained from his Bitcoin account in a phishing scam, according to a state investigation.

An investigator working with the state Bureau of Criminal Apprehension (BCA) Financial Crimes Task Force laid out the Anoka County man’s reverse windfall in a search warrant affidavit filed this week. It seeks to gather information from the prime suspect‘s social media account.

The filing said the task force investigator in recent weeks has been communicating with the suspected cryptocurrency thief, who possibly has ties to Nigeria.

As of Friday, there have been no arrests nor charges in connection with the case, said Brooklyn Park Police Inspector Matt Rabe. The suburban department’s Cyber Unit supervisor, Sgt. Jake Tuzinski, is heading up this investigation.

Once the investigation is complete, the case will be sent to the U.S. Attorney’s Office for consideration of charges, Rabe said. The Minnesota Star Tribune generally does not identify suspects before they are charged.

According to the search warrant affidavit:

The man, identified only as J.S. in the filing, told Tuzinski in September 2024 that “he was on his phone when he received an email from what he thought was Coinbase support. J.S. said he kept all his digital assets, which included over 40 Bitcoin, on his Coinbase Wallet app.”

J.S. continued that “after he clicked on a link contained within the email, he realized the email was not legitimately from Coinbase and suspected it was a phishing attack. J.S. then went to his Coinbase Wallet app and saw his digital assets were being moved out of his wallet.”