Coinbase
Disclosed May 14, 20251 year ago69,461 affectedConfirmed
Bribed support contractors leak Coinbase customer data, $20M extortion
Coinbase said an attacker bribed overseas support contractors to pull customer data from internal systems, then demanded $20 million, which Coinbase refused. Stolen data included names, contact details, last four SSN digits, masked bank data, ID images, balances and transaction history for 69,461 customers.
What is known
| People affected | 69,461 (as reported by the organization) |
|---|---|
| Disclosed | May 14, 2025 |
| Discovered | May 11, 2025 |
| Happened | Dec 26, 2024 |
| Attack | Insider |
| Data exposed | Names, Addresses, Emails, Phone numbers, Social Security numbers, Financial, Government IDs, Internal documents |
| Sector | Crypto · US |
| Status | Confirmed |
| Lawsuit or fine | In re Coinbase Customer Data Security Breach Litigation (filed 2025-08-13) On Lawsuits |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Coinbaseoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Coinbaseatg.wa.gov · Official notice | Official notice |
| Coinbase says customers' personal information stolen in data breachtechcrunch.com · News | News |
| Coinbase says its data breach affects at least 69,000 customerstechcrunch.com · News | News |
| Coinbase Global Form 8-K Item 1.05sec.gov · SEC filing | SEC filing |
| Lawsuits: In re Coinbase Customer Data Security Breach Litigationlawsuits.fru.dev · fru.dev | fru.dev |
| Indiana Attorney General 2025 data breach report: Coinbasein.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | May 14, 2025 | 69,461 |
| California AGresidents of CA | May 20, 2025 | |
| Washington AGresidents of WA | May 20, 2025 | 3,337 |
| Indiana AGresidents of IN | May 30, 2025 | 288 |
Other breaches at Coinbase
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Coinbase confirms contractor improperly accessed data of about 30 customersDec 11, 20259 months agoInsider | Dec 11, 20259 months ago | Insider | Crypto | Confirmed | 32 |
| Disclosed Sep 27, 2021Sep 27, 20214 years ago | Sep 27, 20214 years ago | Not stated | Finance | Confirmed | 6,159 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdf · backfill source
- 2026-09-25 · lawsuits_ref: empty to in-re-coinbase-breach-mdl · weekly source
- 2026-09-25 · lawsuit: empty to In re Coinbase Customer Data Security Breach Litigation (filed 2025-08-13) · weekly source
- 2026-09-25 · sector: finance to crypto · seed source
- 2026-09-25 · attack: hacking to insider · seed source
- 2026-09-25 · data_types: [] to ["names","addresses","emails","phone","ssn","financial","government-id","internal-docs"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 69461 · seed source
- 2026-09-25 · disclosed: 2025-05-20 to 2025-05-14 · seed source
- 2026-09-25 · summary: empty to Coinbase said an attacker bribed overseas support contractors to pull customer data from internal systems, then demanded $20 million, which Coinbase refused. Stolen data included names, contact details, last four SSN digits, masked bank dat · seed source
- 2026-09-25 · title: empty to Bribed support contractors leak Coinbase customer data, $20M extortion · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2025-05-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.