Coinbase Breach: Customer Data Stolen, $20M Ransom Demanded

[albon]

Coinbase, one of the largest cryptocurrency exchanges in the market, revealed that the exchange was the target of a system breach in which customer data and legal documents were stolen.

The attack involved cybercriminals paying and recruiting support agents or employees working in support roles outside the United States to illegally obtain user data, as their job roles granted them access to such information..

After seizing the data, the attackers attempted to extort Coinbase, demanding $20 million in exchange for not publishing the details of the breach. However, Coinbase did not pay the ransom. The attackers managed to steal customers' names, phone numbers, email addresses, and government-issued documents such as national IDs, passports, and driver's licenses.

The company is expected to incur compensation costs for affected users ranging from $180 million to $400 million.

SOURCE:

[1] https://techcrunch.com/2025/05/15/coinbase-says-customers-personal-information-stolen-in-data-breach/
[2] https://www.cnbc.com/2025/05/15/coinbase-says-hackers-bribed-staff-to-steal-customer-data-and-are-demanding-20-million-ransom.html
[3] https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists

[Pmalek]

Who would have thought that a service that stores KYC data on crypto customers in a centralized way and has low-level staff that can access this information at any point in time could be so attractive to scammers? It's surely the first time that something like that has happened. Actually, it has happened many times already and it will continue to happen. The affected Coinbase clients can now enjoy spam calls, phishing emails, online threats, or the occasional visit or two by criminals who operate in their vicinity.

Just make sure you don't hurt the thieves who come after you or your family because that's against the law. You could also cause them emotional damage, the poor things.
I am sure Coinbase will learn from this and introduce new security steps that involves uploading additional data and information about yourself as well as new documents. It will be stored safely, don't worry.   

[JeromeTash]

I am sure Coinbase will learn from this and introduce new security steps that involves uploading additional data and information about yourself as well as new documents. It will be stored safely, don't worry. 

They never learn from the past incidents anyway (There have been so many data breaches involving their competitors). They always tell customers of how safe their data is just for formality via Privacy Policies, but the practices on ground are quite different and very careless.

[Trêvoid]

I heard scammers are even sending out believable and looks real Coinbase text scams to users, i will make a thread for this soon to warn everyone.

[Oshosondy]

I heard scammers are even sending out believable and looks real Coinbase text scams to users, i will make a thread for this soon to warn everyone.

I expected OP to include phishing scam avoidance but I did not see it. This supposed to be the reason he created this thread as we know that the scammers will later sell the data which scammers can use to try to scam Coinbase users.

I do not believe this is just the time Coinbase users data was breached because there are some scam that has been affecting only Coinbase users which might even be as a result of phishing scam attempts.

[Pmalek]

I expected OP to include phishing scam avoidance but I did not see it. This supposed to be the reason he created this thread as we know that the scammers will later sell the data which scammers can use to try to scam Coinbase users.

We already have many threads on Bitcointalk with recommendations on how not to fall for phishing scams. I don't think there is a need to mention it in the OP one more time. I also don't think that the main point of the thread is advising people how to avoid phishing schemes. It's just a topic meant to share information of how Coinbase was breached and had some of its customers' private data stolen by low-level customer support agents.

[examplens]

One good thing from this is that the need for privacy and the shortcomings of KYC are starting to be talked about more aggressively.
So, for example
Bitcoin wallet firm Nunchuk_io

KYC is a disaster waiting to happen.

If it can happen to Coinbase, it can happen to anyone.

https://x.com/nunchuk_io/status/1923002572702437378

Nick Neuman, the CEO of wallet firm Casa

We don't know when this Coinbase data breach happened, but we do know that Coinbase social engineering scams have been rampant for years.

This is why we don't collect KYC by default at Casa. It's one more attack vector for people to use against you.

https://x.com/Nneuman/status/1923025939543339079

Wintermute CEO Evgeny Gaevoy

Coinbase not disclosing this (much much much...) earlier notwithstanding, this is the dark side of the idiotic and nonsensical kyc/aml regime we live in

making life marginally convenient for law enforcement and geopolitical games, while sacrificing our privacy, imposing a massive tax on pretty much all businesses, and making it easier for criminals to rob, kidnap and do crime

https://x.com/EvgenyGaevoy/status/1922975392928768322

[Lucius]

~snip~
The company is expected to incur compensation costs for affected users ranging from $180 million to $400 million.

Those who are affected will at least receive some kind of compensation, which is not a consolation because their data has become public - but something similar happened to Ledger users 5 years ago and that company did not pay anything to anyone, but they tried to present the whole thing as irrelevant. This just shows the way companies treat their customers when it comes to the US versus the EU.

~snip~
Just make sure you don't hurt the thieves who come after you or your family because that's against the law. You could also cause them emotional damage, the poor things.
I am sure Coinbase will learn from this and introduce new security steps that involves uploading additional data and information about yourself as well as new documents. It will be stored safely, don't worry.    

It sounds ironic, but a few years ago I read about cases in my country that were strange to say the least. In the first, the owner caught a thief breaking into the house, the thief ran away and broke his leg, then sued the owner for the injury. In another case, a thief tried to attack the owner in his garage, he called for help and someone reported him for disturbing public order and peace.

I wonder how twisted the laws can be when they treat thieves and thugs better than their victims.

[LoyceV]

Those who are affected will at least receive some kind of compensation, which is not a consolation because their data has become public - but something similar happened to Ledger users 5 years ago and that company did not pay anything to anyone, but they tried to present the whole thing as irrelevant. This just shows the way companies treat their customers when it comes to the US versus the EU.

Here, at best, the company would get a fine.

One good thing from this is that the need for privacy and the shortcomings of KYC are starting to be talked about more aggressively.

Too many people simply don't care. I like to think they can't leak what they don't have, which is a very good reason to keep your private data private.
To quote myself:

Most people don't care about privacy, and they'll tell you they have nothing to hide. That's not true, but life is a lot easier if you don't care about privacy (until it's too late).

[examplens]

Too many people simply don't care. I like to think they can't leak what they don't have, which is a very good reason to keep your private data private.

Now the question is whether Coinbase will inform users whose data has been compromised.
Also, will Coinbase be held responsible if another case similar to the one we had a few days ago Crypto Kidnappings in France Out of Control! happens because of this?
I know it's rhetorical, but until the other side is responsible, things like this will happen.

[Forsyth Jones]

It sounds ironic, but a few years ago I read about cases in my country that were strange to say the least. In the first, the owner caught a thief breaking into the house, the thief ran away and broke his leg, then sued the owner for the injury. In another case, a thief tried to attack the owner in his garage, he called for help and someone reported him for disturbing public order and peace.

I wonder how twisted the laws can be when they treat thieves and thugs better than their victims.

As you mentioned, the Ledger leak was 5y ago and to this day, customers are still being targeted by criminals attempting to defraud them. A recent example of this is phishing letters being delivered to customers' addresses to try to obtain the victims' funds. In the face of leaks like this, customers can become easy targets for future social engineering attempts and eventually fall for these scams, as well as face-to-face attacks (kidnappings, $5 wrench attacks), since the brokerage leaked the addresses of its victims. That said, despite the convenience of exchanges, the tip is to avoid buying bitcoin/crypto from CEX exchanges that require KYC whenever possible, buy from exchanges that require less KYC and, preferably, opt for DEX like Bisq...

While governments are pressuring custody companies to require KYC from their customers, we don't know how companies handle this data, who has access, or what contingency plans they have in case of attacks like this...
- malicious employees can take advantage of the situation or leak customer data through carelessness.
- the weakest link is the customers themselves and they become easy targets after a leak, and can suffer extortion, fraud attempts, cloning and even physical attacks! - Neither companies nor governments guarantee the correct storage of sensitive data and many more reasons that I could mention...

Summary: the EUA and EU governments are a joke and don't care about the consequences of excessive KYC, and they aren't ready to solve the problems mentioned by me and everyone else in this thread. In the end, the state only manages to make things worse than they could have been if they didn't interfere.

At the moment I can only think of Bisq (No KYC) as an alternative, but it's challenging at the moment due to low liquidity and the spread can be more expensive than CEX and a slightly more challenging learning curve.

However, to obtain greater autonomy and privacy to trade Bitcoin it's better to start using DEXs while there's still not enough adoption. More decentralized exchange services and P2P platforms (so far, this is the best site I've found that lists such services): https://bitmixlist.org/

[dkbit98]

They bragged for so long how Coinbase was never hacked, so I guess it was about time for hack to happen.
At least Coinbase is not connected with evil North Korean hackers and their filthy coins, so I guess Coinbase is still ''good'' and approved, we don't need to worry about anything  

[Darker45]

The timing was such a spoiler. Just when Coinbase was in a celebratory mood for its admission in the S&P 500-- the first crypto company to ever hit the prominent index-- this unfortunate incident made a heavy downpour on its parade. 

Just as joining the S&P 500 is associated with a nice reputation, a better investor perception, a great performance, and the like, that would even give them easier access to better capital opportunities, this breach in its system is a big turn-off.

Oh well, that's the price to pay for outsourcing its support system to the farthest corners of the earth to save on operation costs.

They bragged for so long how Coinbase was never hacked...

Was this even a valid claim?

[nonlogs]

Good thing i never registered on coinbase.

[FinneysTrueVision]

They bragged for so long how Coinbase was never hacked...

Was this even a valid claim?

It might be technically true that their wallets have never been hacked and there hadn't been a major data breach prior to this one, but individual accounts get drained for millions of dollars all the time. Unfortunately, they seem to prioritize institutional custody and have neglected average consumers, which could use better theft prevention and improved security measures.

[Pmalek]

Those who are affected will at least receive some kind of compensation, which is not a consolation because their data has become public - but something similar happened to Ledger users 5 years ago and that company did not pay anything to anyone, but they tried to present the whole thing as irrelevant. This just shows the way companies treat their customers when it comes to the US versus the EU.

I see it as a gesture of good will from Coinbase. I am sure there T&Cs don't require them to compensate individuals who fall for social engineering scams but they want to do it anyway for positive press. Coinbase makes much more money than Ledger so it's easier for them in that regard. We are also talking about a smaller number of affected clients compared to the Ledger leak. That's assuming everything Coinbase has said is true.

It sounds ironic, but a few years ago I read about cases in my country that were strange to say the least. In the first, the owner caught a thief breaking into the house, the thief ran away and broke his leg, then sued the owner for the injury. In another case, a thief tried to attack the owner in his garage, he called for help and someone reported him for disturbing public order and peace.

I am not surprised. God forbid you attempt to hold the thief by force in your home against their will until the police comes. That's against the law as well in some countries. When the police arrives, you could both be arrested. The thief, for breaking and entering, and you for your citizen arrest.   

Now the question is whether Coinbase will inform users whose data has been compromised.

They said that they already did. There are some reports going around claiming that Coinbase knew about the stolen and leaked data since January but decided to sit on the information before going public. I am not sure if that is true or not.

[Lucius]

~snip~
While governments are pressuring custody companies to require KYC from their customers, we don't know how companies handle this data, who has access, or what contingency plans they have in case of attacks like this...

I think we've gotten a pretty clear picture of how most companies treat their clients' data, and it could be described in two words - extremely irresponsible. The reason why this is so lies in two things - the first is that they just consider us numbers in their statistics, and the second is that they know very well that practically nothing will happen to them if all this data is leaked to the public.

At the moment I can only think of Bisq (No KYC) as an alternative, but it's challenging at the moment due to low liquidity and the spread can be more expensive than CEX and a slightly more challenging learning curve.

DEX is certainly a better choice than any centralized solution, but only for those who have no problem with their banks, and consequently their tax office, being aware of such transactions. In addition, I have already mentioned that the possibility that among traders on DEXs there are those who not only want to trade, but also those who collect data about those with whom they trade - whether they are malicious persons or covert secret agents.

[Z-tight]

Good thing i never registered on coinbase.

Yeah good thing you never did, however if you registered in any other centralized exchange, then take note that the very same thing could happen to them too. Any service that holds their customers data is vulnerable to a data breach, same as any service that holds customers money can be hacked or fail and people lose their money.

[Darker45]

They bragged for so long how Coinbase was never hacked...

Was this even a valid claim?

It might be technically true that their wallets have never been hacked and there hadn't been a major data breach prior to this one, but individual accounts get drained for millions of dollars all the time. Unfortunately, they seem to prioritize institutional custody and have neglected average consumers, which could use better theft prevention and improved security measures.

What happened recently isn't even a breach in their wallet, so they may continue to brag that they've never been hacked. But that may not be strictly true because just a few years ago they were also reimbursing users' funds because of a successful hack. And it wasn't an attack directed at individual wallets which are largely under the control of their users. It was an attack against their SMS-based 2FA system resulting to more than 6,000 compromised accounts.

[bbc.reporter]

Who would have thought that a service that stores KYC data on crypto customers in a centralized way and has low-level staff that can access this information at any point in time could be so attractive to scammers? It's surely the first time that something like that has happened. Actually, it has happened many times already and it will continue to happen. The affected Coinbase clients can now enjoy spam calls, phishing emails, online threats, or the occasional visit or two by criminals who operate in their vicinity.

Just make sure you don't hurt the thieves who come after you or your family because that's against the law. You could also cause them emotional damage, the poor things.
I am sure Coinbase will learn from this and introduce new security steps that involves uploading additional data and information about yourself as well as new documents. It will be stored safely, don't worry.    

Also, what would be the use of Coinbase and other centralized exchanges to impose KYC on users if these exchanges will only act as something to mine information from users in the cryptospace. This is also certainly why users are beginning to prefer a worse experience from DEXs to avoid KYC.

I predict that the first DEX team that could create an experience for users similar to CEX will certainly make much money in revenues from fees hehehehee.

This is the information on what was leaked. This is very headshaking.