INCIDENT REPORT · CP-2025-006

Coinbase insider-enabled customer data breach

L2 · GUARDEDCONFIRMED

Coinbase disclosed in an SEC 8-K that criminals had bribed a small group of overseas support staff to copy customer data, then demanded a $20 million ransom, which the company refused.

Incident ID: CP-2025-006
Disclosure date: 15 MAY 2025
Detection date: Not publicly documented
Affected countries: United States
Plotted location: San Francisco, United States (Affected organization's former headquarters (company is remote-first))
Threat classification: Level 2 — GUARDED
Classification rationale: Significant data exposure and fraud risk at a major exchange, without operational disruption.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Bribed overseas customer-support contractors/insiders copied data from internal support tools
Sectors: Finance
Critical infrastructure: No
Organizations affected: Coinbase
Operational consequences: Data of fewer than 1% of monthly transacting users (about 70,000 customers per reporting) was exposed, enabling impersonation scams; no passwords, private keys or funds were accessed. Coinbase pledged to reimburse customers tricked as a result.
Estimated financial impact: $400M — Coinbase 8-K (15 May 2025) estimated remediation and reimbursement costs of $180 million to $400 million; figure shown is the upper bound.
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Coinbase insider-enabled customer data breach

L2 · GUARDEDCONFIRMED

Coinbase disclosed in an SEC 8-K that criminals had bribed a small group of overseas support staff to copy customer data, then demanded a $20 million ransom, which the company refused.

Incident ID

CP-2025-006

Disclosure date

15 MAY 2025

Detection date

Not publicly documented

Affected countries

United States

Plotted location

San Francisco, United States (Affected organization's former headquarters (company is remote-first))

Threat classification

Level 2 — GUARDED

Classification rationale

Significant data exposure and fraud risk at a major exchange, without operational disruption.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Bribed overseas customer-support contractors/insiders copied data from internal support tools

Sectors

Finance

Critical infrastructure

Organizations affected

Coinbase

Operational consequences

Data of fewer than 1% of monthly transacting users (about 70,000 customers per reporting) was exposed, enabling impersonation scams; no passwords, private keys or funds were accessed. Coinbase pledged to reimburse customers tricked as a result.

Estimated financial impact

$400M — Coinbase 8-K (15 May 2025) estimated remediation and reimbursement costs of $180 million to $400 million; figure shown is the upper bound.

Attribution (as stated)

No official attribution recorded