Coordinated action by three U.S. agencies has uncovered a phishing and spoofing attack that exploited three legitimate cryptocurrency platforms resulting in a loss of $16.8m, the Californian Department of Justice, the Department of Homeland Security, and the U.S. Treasury’s Office of Foreign Assets Control have announced.