Coinbase Faces Data Breach Affecting Over 69,000 Users

TLDR

• 69,461 users affected by unauthorized data access.
• Coinbase delayed breach disclosure until May 2025.
• Remediation costs estimated between $180 million and $400 million.

Coinbase, one of the world’s largest cryptocurrency exchanges, faced a significant data breach that came to public attention in May 2025. Reuters reported that the exchange had knowledge of the security issue earlier in January 2025 but delayed disclosing it publicly.

This breach affected 69,461 users and involved unauthorized access to sensitive data. This included names, contact information, government ID photos, and partial financial information. Although passwords and private keys were not compromised, attackers used stolen data to conduct social engineering attacks.

Delayed Disclosure Raises Transparency Concerns

The delay in disclosing the breach has attracted scrutiny. Coinbase submitted a disclosure to the SEC, revealing that they knew about the unauthorized data access as early as January. However, public acknowledgment came only in May through a company blog post. This has led to questions regarding the company’s transparency and regulatory compliance.

The official notification filed with the Maine Attorney General detailed the extent of the breach. Insiders in India were reportedly bribed to access and leak user data, which facilitated considerable financial theft. Coinbase’s extortion attempt was noted in an SEC filing. A $20 million ransom was demanded by attackers, but Coinbase refused.

Response and Legal Action

Following the breach, Coinbase has coordinated with law enforcement rather than complying with ransom demands. According to an announcement from DOJ, investigations are ongoing with international support to pursue criminal charges against the culprits. Paul Grewal, the Chief Legal Officer, confirmed this collaboration in a statement dated May 19, 2025.

Coinbase has also started to reimburse affected users and support them with identity protection services. The remediation cost is estimated between $180 million and $400 million, further underscoring the breach’s severity.

Strengthening Security Measures

Coinbase has fired the implicated employees and is actively enhancing security protocols to prevent future issues. These steps include stronger control measures and systems to mitigate insider threats. The company’s commitment includes a $20 million reward for information leading to arrests, reflecting its proactive security approach.

As the situation unfolds, the emphasis remains on improving security frameworks within centralized exchanges. While the blockchain itself was not compromised, insider vulnerabilities continue to pose significant risks in crypto ecosystems.