Understanding the Coinbase Data Breach: Legal Help for Victims

Rooted in insider manipulation as opposed to a direct exploit of the exchange’s core systems or vulnerabilities, the breach has affected nearly 70,000 users and could potentially cost Coinbase up to $400 million.

While Coinbase publicly disclosed the incident in May 2025, it appears that the company was aware of potential leaks as early as January 2025. What’s more, it hasn’t yet publicly disclosed the exact number of customers who lost funds directly due to these scams, instead calling it a “small subset of customers”, though external reports provide some indication of the scale.

Independent security investigators are suggesting that approximately $65 million was stolen from users between December 2024 and January 2025. As they noted, the actual losses could be higher, since the data was limited to direct messages about on-chain thefts and didn’t include Coinbase support tickets or police reports.

How threat actors pulled off the data breach

The theft occurred due to bribed overseas customer support agents, primarily from an outsourcing firm called TaskUs, a US business process outsourcing (BPO) company with operations in India. These agents were paid in cash to leak sensitive customer data and internal documentation, leading to the expropriation of user and account details and a subsequent $20 million ransom demand. 

The stolen information was then employed for social engineering scams. First, a scammer would contact a user through a phone call, email, or text message and convincingly pose as a Coinbase customer service agent. They would warn the user about urgent issues, like suspicious activity on their account, and use official-sounding language or even fake verification codes to gain their trust.

From there, they would trick the user to transfer their crypto out of their Coinbase account into a so-called “Coinbase Wallet” or another external address they control, all under the guise of “protecting” their funds. Once the coins were moved to their wallet, the scammer disappeared. This method relies on psychological manipulation, exploiting trust and urgency to coerce victims into making unauthorized transactions.

What Information Was Stolen?

The attackers made off with a fair share of confidential customer data, including:

• First and last name
• Address
• Phone
• Email
• Images of government‑issued documents, such as a passport and a driver’s license
• Last four digits of Social Security
• Limited account data, like balance snapshots and transaction history
• Some bank account identifiers, including masked bank account numbers
• Certain corporate data, including documents, training material, and communications that support agents were privy to

That said, it’s also worth mentioning what the criminals didn’t or couldn’t access, starting with login credentials, two-factor authentication (2FA) codes, or private keys. This meant that the attackers didn’t gain direct access to Coinbase accounts or customer funds from Coinbase’s hot or cold wallets.

The attack vector focused on exploiting human vulnerabilities and social engineering, rather than breaching Coinbase’s fundamental cryptographic security. Once again, the unfortunate event underscores the fact that, more times than not, the weakest link in a security chain is often the human, not technology.

Potential Risks to Customers

After an event like this, the primary risk is the heightened vulnerability to social engineering scams and potential identity theft. Although attackers could not directly access or move customer funds from Coinbase’s vaults, they obtained a wealth of personal data that can be leveraged for impersonation scams such as the Coinbase Support Impersonation scam.

For example, threat actors can contact you via email, phone, or text, referencing specific details about your account or transactions to appear legitimate. Their goal is to trick you into revealing further sensitive information or, more commonly, to persuade you to send your cryptocurrency to a wallet they control.

The stolen data allows for highly personalized phishing attempts, making it harder to distinguish fake communication from genuine. These could lead you to scam but legitimately-looking websites designed to steal your login credentials or other personal data.

Then, the combination of stolen personal details could potentially be used by criminals to attempt various forms of identity theft, such as opening new accounts in your name or accessing other personal services.

How Coinbase responded to the incident

Coinbase was first alerted to a potential data leak involving an employee of its outsourcing partner, TaskUs, as early as January 2025, according to reports from Reuters. This early awareness suggests that internal investigations and mitigation efforts were likely underway for several months before the incident became public.

Following the discovery of the data theft, Coinbase issued a statement saying that it “cut ties with the TaskUs personnel involved and other overseas agents, and tightened controls”. On May 11, the exchange received an unsolicited email from an unknown threat actor who claimed to possess private customer information and demanded a ransom of $20 million. Coinbase subsequently rejected the ransom and publicly disclosed the incident on May 14.

In an effort to mitigate the damage from the breach, the company committed to reimbursing customers who were deceived into sending funds due to the impact of the social engineering scams. To further protect these users, Coinbase is providing one year of complimentary credit monitoring and identity protection services. This package includes a $1 million insurance reimbursement policy for identity theft and dark web monitoring to detect if personal information appears on illicit online platforms.

Furthermore, there are now extra security safeguards being implemented. Affected accounts will now require additional identity verification for large withdrawals, and mandatory scam-awareness prompts have been integrated into the user experience to help prevent future social engineering attacks. Coinbase is also opening a new support hub in the United States and has implemented stronger security controls and monitoring across all locations to prevent insider threats.

Finally, the exchange is actively cooperating with both US and international law enforcement agencies to bring the perpetrators to justice. As a counterpoint to the $20 million ransom attempt, it has established a $20 million reward fund for information leading to the arrest and conviction of the attackers.

What you can do to protect yourself against The data breach

To safeguard your cryptocurrency assets and personal information, consider the following essential protection measures:

• Be wary of impersonators and unsolicited requests: Never share your password, 2FA codes, or recovery phrases with anyone claiming to be from a crypto platform. Always remember that legitimate exchanges will never ask you to transfer crypto to a “new” or “safe” wallet, nor will they request security credentials over the phone, text, or email. It’s ok to be suspicious of communications that demand immediate action or sensitive information.
• Enable strong 2FA: Prioritize using a hardware security key or a dedicated authentication app for 2FA, if possible, since the SMS-based option is more vulnerable to SIM-swapping attacks.
• Utilize wallet address allow-listing (if your exchange offers it): This feature restricts withdrawals to only pre-approved wallet addresses you control, adding another layer of protection against unauthorized transfers even if your account is compromised.
• Act immediately if anything feels suspicious: Lock your account through the official app or platform and report the incident directly to customer support via their verified channels.
• Stay in the know: Regularly inform yourself about the latest security tips and updates to recognize and avoid evolving scam tactics.
• Never share your private keys: They are the ultimate access to your cryptocurrency. Under no circumstances should you share them with anyone, store them on internet-connected devices, or expose them publicly. Consider using hardware wallets for enhanced security.

How Marin & Murphy can help you

If you’ve been victimized, it’s crucial to act fast to protect your rights and your finances, especially in a case of a magnitude like the Coinbase incident. The Marin & Murphy Law Firm can assist affected clients through litigation, arbitration, or other recovery efforts.

Call our firm (the office that’s nearest to you) or fill out our online contact form to speak with a knowledgeable crypto scam attorney. We’ll quickly review your situation, answer your questions, and start building a plan to recover your funds. We’ll also help you determine if there is sufficient evidence of fraud, misrepresentation, or negligence to build a strong case.

And before you ask – yes, you can bring a claim against cryptocurrency exchange if it’s responsible for negligence, breach of contract, or security failures leading to your loss. In this instance, legal claims may involve inadequate security measures, failure to prevent hacks, or mishandling of funds. Under some circumstances, these may need to be brought as an arbitration proceeding instead of a civil lawsuit.

Your initial consultation is 100% free and confidential. You truly have nothing to lose by talking to us, and potentially a lot to regain. Our team is ready to provide the urgent legal support you need, day or night. We understand the urgency of these cases and will treat yours with the priority it deserves.

Take the first step now: dial 888-348-2735 or message us now for a consultation free of charge. Your crypto may be stolen, but with our help, you may have avenues to recover the funds.