Skip to content
Breach Index · running record

Coinbase data breach (2025): bribed support agents, 69,461 customers, and what Coinbase confirmed

The Coinbase breach was not a hack of the exchange’s wallets or code. Criminals paid support staff outside the US to pull customer records from internal tools, then tried to extort Coinbase. This page is the running record: what Coinbase told the SEC, what the state filings add, what has happened since, and what customers and security leaders should take from it.

Short answer

Was Coinbase hacked?

Yes, through insiders rather than a technical exploit. In a Form 8-K filed with the SEC in May 2025, Coinbase said criminals paid contractors or employees in support roles outside the US to copy customer data from internal systems. It learned of it on 11 May 2025, when the attacker emailed an extortion demand, which Coinbase did not pay.

A notice Coinbase filed with Maine’s Attorney General put the number of affected people at 69,461 and the start of the breach at 26 December 2024. Exposed data included names, addresses, phone numbers and emails, the last four digits of Social Security numbers, masked bank details, government ID images and account history. Passwords, private keys and customer funds were not accessed, per the 8-K. Coinbase estimated the cost at $180 million to $400 million.

Timeline at a glance

  1. 26 Dec 2024Breach begins, per Coinbase’s Maine AG notice. (The Register / Maine AG)Confirmed
  2. 11 May 2025Attacker emails Coinbase claiming customer data and demanding payment. (SEC 8-K)Confirmed
  3. 15 May 20258-K filed: bribed overseas support staff; $180M–$400M estimated cost; no ransom paid. (SEC 8-K)Confirmed
  4. 21 May 2025Maine AG filing: 69,461 people affected. (The Register)Confirmed
  5. Dec 2025Former support agent arrested in Hyderabad, India; outsourcer TaskUs named in reporting. (BleepingComputer)Reported

Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Coinbase incident timeline, in detail

Confirmed = acknowledged by Coinbase, a regulator filing or a court. Reported = credible reporting Coinbase has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Dec 2024 – May 2025ConfirmedInsider / outsourced support

Bribed support agents copy customer records; Coinbase discloses a material cybersecurity incident

What happened. Coinbase’s 8-K (Item 1.05, filed 15 May 2025) says an unknown threat actor paid multiple contractors or employees working in support roles outside the US to collect information from internal Coinbase systems they could reach for their jobs. Coinbase’s security monitoring had detected the improper access in the previous months and it had fired the people involved; on 11 May 2025 the actor emailed claiming to hold customer account information and internal documents and demanded money not to publish it. Coinbase said it had not paid.

Impact. Per the 8-K: names, addresses, phone numbers and emails; the last four digits of Social Security numbers; masked bank account numbers and some bank identifiers; government ID images; account data such as balance snapshots and transaction history; and limited corporate data available to support agents. Passwords, private keys and customer funds were not accessed. The Maine AG notice gives 69,461 affected people. Coinbase preliminarily estimated $180M–$400M in remediation and voluntary reimbursement of customers tricked into sending funds.

Sources: Coinbase Form 8-K (SEC), May 2025 · The Register — Maine AG figure, 21 May 2025

Sept 2024 – 2026ReportedThird-party / BPO

Outsourcer TaskUs tied to the breach in court filings and reporting

What happened. Coinbase’s 8-K does not name a vendor. Later reporting and a US court filing tie the bribed agents to TaskUs, an outsourcing firm whose India-based staff handled Coinbase support; one filing alleges a TaskUs employee agreed to sell Coinbase user data as early as September 2024. BleepingComputer reported that TaskUs said two individuals were involved and that it shut down the affected 226-person department. TaskUs denies negligence.

Impact. Moves the case from “insider” to “third-party insider”: the access path was a contractor’s legitimate support tooling, which is why outsourced support is now a standard line in vendor-risk reviews.

Sources: BleepingComputer, Dec 2025 · Infosecurity Magazine — court filing

Dec 2025ReportedLaw enforcement

First arrest: a former Coinbase support agent detained in Hyderabad

What happened. Coinbase CEO Brian Armstrong announced that police in Hyderabad, India, had arrested a former Coinbase customer-service agent accused of helping the attackers, and said more arrests were expected.

Impact. The first criminal action tied to the breach. No charging documents were public at the time of reporting.

Sources: BleepingComputer, 29 Dec 2025

Where the reports disagree

  • How many customers? Coinbase’s Maine AG notice gives 69,461. Some outlets published higher estimates (roughly 84,000–97,000) before that filing; the state filing is the more precise figure and is the one used here.
  • When did it start? The Maine notice dates the breach to 26 December 2024; reporting on court filings alleges recruitment of agents from September 2024. Both can be true: the earlier date is when an agent allegedly agreed to sell data, the later one when Coinbase dates the data access.
  • What did it cost? The 8-K gives a preliminary $180M–$400M range. Later figures in secondary reporting have not been checked against a Coinbase filing here, so we do not state a final number.

The pattern across the record

The insider was a contractor, and the tool was legitimate

Nothing was exploited. Support agents used the access their jobs required, which is why perimeter controls never fired. The control that matters is how much customer data a single support seat can see and export, and how fast unusual lookups are flagged.

Extortion turned a data leak into a disclosure event

Coinbase had already detected and fired the insiders; the extortion email made it material. Refusing to pay and filing the 8-K within days set the public record, which is why this case is unusually well documented.

Partial data is enough for social engineering

Without passwords or keys, the stolen records were still ideal for impersonation scams: a caller who knows your balance, ID photo and address sounds like Coinbase. That is where the customer losses, and the reimbursement cost, came from.

What it means for Coinbase customers — and what to do

If you hold a Coinbase account, the risk from this breach is not someone logging in with a stolen password; it is someone who knows enough about you to sound like Coinbase. If you run a company, the lesson is about outsourced support.

  1. 1.Treat any “Coinbase support” call or text as suspect

    Coinbase will not ask you to move funds to a “safe” wallet. Hang up and contact support through the app. The stolen data (balances, ID images, addresses) is exactly what an impersonator needs.

  2. 2.Turn on phishing-resistant sign-in and withdrawal allow-lists

    Use a passkey or hardware security key rather than SMS codes, and restrict withdrawals to addresses you have approved in advance.

    Phishing-resistant MFA planner
  3. 3.Watch for identity misuse, not only crypto theft

    The last four SSN digits and an ID image help with account takeovers elsewhere. A credit freeze with the three US bureaus is free and blocks new-credit fraud.

  4. 4.For businesses: scope what an outsourced support seat can see

    Limit lookups to the ticket in hand, mask identifiers by default, alert on bulk or off-pattern record views, and put insider-risk clauses and audit rights in the BPO contract.

    Insider data-theft lab

CISO takeaways

Rehearse an insider data theft

Walk through detection, containment and disclosure when the person exfiltrating data has legitimate access.

Insider Data Theft Lab
Score your outsourced providers

BPO and support vendors hold customer data at scale. Score them on access scoping, monitoring and hiring controls.

Vendor Risk Scorecard
Have an insider-incident runbook

Who decides, who investigates and how HR, legal and security work together when it is staff.

Insider IR checklist
Map the notification clocks

SEC Item 1.05, state AG notices and customer letters run on different clocks. Map them before you need them.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed October 30, 2026.

  1. 1.Coinbase Global, Form 8-K, Item 1.05 (material cybersecurity incident) — SEC EDGAR, 15 May 2025
  2. 2.Coinbase confirms insiders handed over data of 70K users — The Register, 21 May 2025
  3. 3.Former Coinbase support agent arrested for helping hackers — BleepingComputer, 29 Dec 2025
  4. 4.TaskUs employees behind Coinbase breach, US court filing alleges — Infosecurity Magazine, 2025

Frequently asked questions

Was Coinbase hacked?

Yes, but not through a technical exploit. Coinbase told the SEC in May 2025 that criminals bribed contractors or employees in overseas support roles to copy customer data from internal tools. A state filing put the number of affected people at 69,461. Passwords, private keys and customer funds were not accessed.

What data was exposed in the Coinbase data breach?

Per Coinbase’s 8-K: names, addresses, phone numbers and emails; the last four digits of Social Security numbers; masked bank account numbers and some bank identifiers; government ID images such as driver’s licences and passports; account data such as balance snapshots and transaction history; and limited internal corporate documents.

Did Coinbase pay the ransom?

No. Coinbase’s 8-K says the attacker demanded money not to publish the data and that Coinbase had not paid. BleepingComputer reported the demand as $20 million.

How much did the Coinbase breach cost?

Coinbase’s preliminary estimate in the 8-K was $180 million to $400 million, covering remediation and voluntary reimbursement of retail customers tricked into sending funds to the attackers. The filing said the figure could change.

Who was behind the Coinbase breach?

Coinbase has not named the external group. Reporting and a US court filing tie the bribed agents to the outsourcing firm TaskUs, which said two individuals were involved. In December 2025 police in Hyderabad, India, arrested a former Coinbase support agent, according to Coinbase’s CEO.

What should Coinbase customers do now?

Assume scammers may know your name, address, balance and ID details. Do not trust inbound “Coinbase support” calls, never move funds to a wallet someone else gives you, use a passkey or security key, set a withdrawal allow-list, and consider a free credit freeze.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Deloitte data breachBig Four

The 2017 no-MFA email breach and the $12M RIBridges incident.

PwC data breachBig Four

The Oct 2026 vendor incident, MOVEit and LuxLeaks.

EY (Ernst & Young) data breachBig Four

MOVEit, a 2025 Azure backup exposure, a third-party signature.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Coinbase. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout