Coinbase Data Breach: What Was Exposed and What to Do

The attackers did not hack Coinbase’s systems. They paid people with access to customer data.

By Siddharth ShankarUpdated October 22, 2026

Most breach stories are about hackers breaking in. The Coinbase case is about insiders. The attackers recruited support staff, which is why strong passwords alone would not have helped.

What happened

Coinbase disclosed the incident in a May 2025 blog post and a filing with the US Securities and Exchange Commission dated May 14. Help Net Security reports that the attackers emailed Coinbase demanding money on May 11.

Coinbase said criminals bribed customer support agents and contractors, mostly outside the US, to copy customer data from internal systems. No Coinbase systems or networks were compromised, according to the report, and monitoring flagged staff accessing data without a business need, so those agents were terminated. TechCrunch reports the breach began on December 26, 2024 and continued until early May 2025.

How many customers

A filing with the Maine Attorney General listed 69,461 affected customers. Coinbase described the group as less than 1% of monthly transacting users.

What data was exposed

Coinbase said exposed data included:

• names, addresses, phone numbers and email addresses,
• masked Social Security numbers and masked bank account numbers, plus some bank account identifiers,
• images of government-issued IDs,
• account balance snapshots and transaction history,
• limited internal corporate material available to support agents.

What was not exposed

Coinbase said no passwords, private keys or funds were exposed, and that Coinbase Prime accounts were untouched. Attackers did not get login credentials or two-factor codes, and could not move customers’ funds directly.

The ransom demand

The attackers demanded $20 million to stay quiet. Coinbase said no, and announced a $20 million reward fund for information leading to the arrest and conviction of those responsible. It also said it would voluntarily reimburse retail customers who were tricked into sending funds to scammers because of the incident, subject to review.

The real risk: impersonation

The attackers planned to contact customers while pretending to be Coinbase and trick them into sending crypto. A person who already knows your name, address, balance and recent activity sounds convincing. Coinbase says it will never ask for your password or two-factor codes, and will never ask you to move assets to a new address.

What to do

• Treat any call, text or email about Coinbase with suspicion. Hang up and use the app.
• Turn on withdrawal allow-listing and strong two-factor authentication, with hardware keys preferred, as Coinbase advises.
• If something seems wrong, lock your account in the app and email Coinbase’s security team.
• Help Net Security reports free one-year credit monitoring was offered to affected customers.
• If you are in the US, think about a credit freeze, since partial Social Security and ID images were involved.

A wider lesson

Crypto holders are targeted through phones as well. Read about SIM swapping in this London case.