Retired artist Ed Suman lost over $2 million in cryptocurrency earlier this year after falling victim to a scam involving someone posing as a Coinbase support representative.

Suman, 67, spent nearly two decades as a fabricator in the art world, helping build high-profile works such as Jeff Koons’ Balloon Dog sculptures, according to a May 17 report by Bloomberg.

After retiring, he turned to cryptocurrency investing, eventually accumulating 17.5 Bitcoin (BTC) and 225 Ether (ETH) — a portfolio that comprised most of his retirement savings.

He stored the funds in a Trezor Model One, a hardware wallet commonly used by crypto holders to avoid the risks of exchange hacks. But in March, Suman received a text message appearing to be from Coinbase, warning him of unauthorized account access.

After responding, he got a phone call from a man identifying himself as a Coinbase security staffer named Brett Miller. The caller appeared knowledgeable, correctly stating that Suman’s funds were stored in a hardware wallet.

He then convinced Suman that his wallet could still be vulnerable and walked him through a “security procedure” that involved entering his seed phrase into a website mimicking Coinbase’s interface.

Nine days later, a second caller claiming to be from Coinbase repeated the process. By the end of that call, all of Suman’s crypto holdings were gone.

Related: Bitcoin breaks out while Coinbase breaks down: Finance Redefined

Coinbase suffers major data breach

The scam followed a data breach at Coinbase disclosed this week, in which attackers bribed customer support staff in India to access sensitive user information.

Stolen data included customer names, account balances, and transaction histories. Coinbase confirmed the breach impacted roughly 1% of its monthly transacting users.

Among those affected was venture capitalist Roelof Botha, managing partner at Sequoia Capital. There is no indication that his funds were accessed, and Botha declined to comment.

Coinbase’s chief security officer, Philip Martin, reportedly said the contracted customer service agents at the center of the controversy were based in India and had been fired following the breach.

The exchange has also said it plans to pay between $180 million and $400 million in remediation and reimbursement to affected users.

Magazine: Arthur Hayes $1M Bitcoin tip, altcoins’ powerful rally’ looms: Hodler’s Digest, May 11 – 17