TL;DR: In May 2025 Coinbase disclosed that criminals had paid overseas support contractors to copy customer data from internal tools. A Maine attorney general filing put the number affected at 69,461. Exposed: names, addresses, phone numbers, emails, last four SSN digits, masked bank details, government ID images and some balances and transaction history. Passwords, 2FA codes and private keys were not taken. Coinbase refused a $20 million ransom. The real danger is impersonation scams using this data.
What happened
On 15 May 2025 Coinbase confirmed a breach in an SEC filing. As Help Net Security reported, no Coinbase systems were hacked. Instead, criminals bribed a small number of overseas support contractors and employees to pull customer data from the internal tools they used for their jobs. The attackers emailed Coinbase on 11 May demanding $20 million.
Coinbase refused to pay and instead offered a $20 million reward for information leading to the attackers' arrest and conviction. It fired the agents involved. TechCrunch reported that Coinbase's filing with Maine's attorney general put the number affected at 69,461, and that the activity began on 26 December 2024.
What data was exposed
- Names, addresses, phone numbers and email addresses
- Last four digits of Social Security numbers
- Masked bank account numbers and some bank identifiers
- Images of government ID such as driver's licences and passports
- Account data including balance snapshots and transaction history
Not exposed
Login credentials, 2FA codes, private keys and the ability to move customer funds were not affected, Coinbase said. Coinbase Prime accounts were not involved.
Why this breach is dangerous
A scammer who knows your name, address, account balance and recent transactions sounds exactly like Coinbase support. That's the point. The common follow-up is a call or text saying your account is compromised and you must move funds to a “safe wallet.” Coinbase said it would reimburse retail customers who were tricked into sending funds to scammers because of this incident. Our guide to Coinbase phishing scams shows the scripts.
Was I affected?
- If you were affected, look for a notice from Coinbase in your email and in the Coinbase app. Never trust a link in a text claiming to be that notice.
- Coinbase offered affected customers a year of free credit monitoring and identity protection.
- Even if you weren't notified, expect copycat messages: scammers target all crypto users after a breach like this.
What to do now
- Never move funds because someone called you. Coinbase support won't ask you to transfer crypto to a new wallet.
- Use app-based 2FA or a passkey, not SMS. SMS can be hijacked through SIM swap fraud.
- If your ID image was exposed, watch for accounts opened in your name. In the US, consider a credit freeze and see how to report identity theft to the FTC.
- Check your exposure elsewhere. Read is Coinbase safe for account hardening tips.
A free email exposure check shows whether your email appears in other known breaches, and the full Scan My Shadow scan adds your phone number.
Frequently Asked Questions
Was there a Coinbase data breach?
Yes. In May 2025 Coinbase disclosed that bribed overseas support contractors copied customer data from internal tools. A Maine filing put the number affected at 69,461.
What data was leaked in the Coinbase breach?
Names, addresses, phone numbers, emails, last four SSN digits, masked bank details, government ID images, balance snapshots and transaction history.
Were Coinbase passwords or crypto stolen?
Coinbase said login credentials, 2FA codes, private keys and the ability to move funds were not affected.
Did Coinbase pay the ransom?
No. Coinbase refused the $20 million demand and offered a $20 million reward for information leading to the attackers’ arrest and conviction.
What scams followed the Coinbase breach?
Calls and messages posing as Coinbase support that use real account details to push victims into moving crypto to wallets controlled by scammers.
Sources
- Help Net Security: Coinbase suffers data breach, gets extorted (but won’t pay) (May 2025)
- TechCrunch: Coinbase says its data breach affects at least 69,000 customers (May 2025)