[examples] separate two $300M+ figures that had collapsed into one line

The Coinbase support-impersonation file recorded $300M+ as money taken from
users, attributed to FOIA data, and separately recorded $300M+ as the amount
Coinbase's risk models prevented. They are different quantities that round to
the same number, the FOIA reference belongs to a different ZachXBT post about
account restrictions, and the taken figure is an annualisation of ~$65M
observed over two months — not a count.

Found downstream: the book had printed the FOIA provenance in chapter 6 and in
its verification index before the collision was traced back here.

Author: iZonex

examples/2023-2026-coinbase-support-impersonation.md

@@ -1,6 +1,6 @@
 # Coinbase Support Impersonation — Multi-Victim Social Engineering — 2023–2026
 
-**Loss:** $300M+ annually across Coinbase users (per FOIA data); individual cases range from $275K to ~$16M (Spektor, per the Brooklyn indictment).
+**Loss:** ~$300M+/yr taken from Coinbase users — **an annualisation, not a count**: ZachXBT observed roughly $65M leaving users over about two months (Feb 2025) and extrapolated. Individual cases range from $275K to ~$16M (Spektor, per the Brooklyn indictment). **Do not confuse this with the separate $300M+ figure below**, which is what Coinbase's risk models *prevented*; the two are different quantities that happen to round to the same number, and the collision has already produced one downstream error. The FOIA reference in the sources list belongs to a different ZachXBT post, about account restrictions — it is not the provenance of this loss figure.
 **OAK Techniques observed:** OAK-T4.007 (Native App Social Phishing) — primary. The attack pattern is consistent across multiple identified threat actors.
 **Attribution:** **confirmed** — Ronald Spektor (23, Sheepshead Bay, Brooklyn; handle @lolimfeelingevil; **~\$16M from ~100 users nationally**, not \$6.5M as previously recorded here — see the Brooklyn DA's 31-count indictment of 2025-12-19, charging first-degree grand larceny, first-degree money laundering and scheme to defraud; ~1 year of activity; \$105K cash and ~\$400K crypto seized; apprehended via transaction records, blockchain analysis, digital forensics and IP linkage to the receiving wallets), Christian Nieves ("Daytwo/PawsOnHips", $4M+), Haby/Havard ($2M+, Canadian), Indian call scammer ring (elderly victim, $275K recovered).