Coinbase data breach 2025: What was stolen and what you need to know

Coinbase’s May 2025 data breach, a significant cybersecurity incident at America’s largest cryptocurrency exchange, highlighted vulnerabilities in even well-funded security systems. The breach, which wasn’t a typical crypto hack, involved insider manipulation and corporate espionage. It started with the recruitment of overseas customer service agents who leaked sensitive customer data and internal documentation.

Coinbase’s internal security team detected suspicious activity, leading to the termination of implicated employees. On May 11th, an unsolicited email demanded a $20 million ransom, claiming possession of stolen data. Instead of paying, Coinbase reported the breach to law enforcement, publicly disclosed the incident, and offered a $20 million reward for information leading to the attackers’ arrest.

The breach impacted 69,461 accounts, compromising names, addresses, phone numbers, email addresses, government ID images, masked Social Security numbers, account data, and partially masked bank details. Critically, login credentials, private keys, and access to funds remained secure. The attackers aimed to use the stolen data for social engineering attacks.

Coinbase’s response included refusing the ransom, committing to reimbursing affected customers (estimated costs: $180-$400 million), providing one year of complimentary identity theft protection services, enhancing customer safeguards, strengthening support operations, collaborating with law enforcement, and maintaining transparency.

To protect yourself from similar breaches, avoid sharing sensitive information with impersonators, enable wallet address allow-listing, utilize strong 2FA (avoiding SMS-based), be cautious of unsolicited communication, lock your account immediately if suspicious activity occurs, and stay informed about evolving scam tactics. The Coinbase breach serves as a stark reminder of the persistent threat of sophisticated cyberattacks and the importance of robust security practices across the cryptocurrency industry.