Yes—the Coinbase data breach was real. Disclosed in May 2025, it involved criminals allegedly bribing or recruiting overseas support personnel to copy customer information from internal systems. Coinbase said the incident may have exposed names, contact details, identity-document images, account information and transaction history for some customers, but not passwords, two-factor authentication codes, private keys or direct access to customer funds and wallets.
The main danger is therefore targeted impersonation and social engineering, not an attacker directly draining Coinbase wallets. If you received a notice, secure your account, freeze your credit if appropriate, and treat any unsolicited “Coinbase” call or message as hostile until independently verified.
As an Amazon Associate I earn from qualifying purchases.
What happened in the Coinbase breach?
Coinbase described the incident as an insider-assisted data theft rather than a conventional external database intrusion. According to its SEC filing, criminals paid or recruited multiple contractors or employees in overseas support roles to access and copy customer information without a business need.
Coinbase said it had detected improper access during the preceding months and connected the activity to one criminal campaign after receiving an extortion email on May 11, 2025. The attackers demanded $20 million not to publish the information. Coinbase said it refused to pay, terminated the personnel involved and cooperated with law enforcement.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Coinbase publicly disclosed the incident on May 15, 2025. Instead of paying the demand, it announced a $20 million reward fund for information leading to the attackers’ arrest and conviction. The company said the affected group represented less than 1% of monthly transacting customers.
A later Maine breach notification was reported as identifying at least approximately 69,000 customers. That figure should be treated as a reported minimum or jurisdiction-specific filing figure—not automatically as the final worldwide total. Reporting indicated that the activity began no later than December 26, 2024.
What information may have been exposed?
Coinbase’s wording indicates that the following information may have been included. It does not mean every affected customer had every category exposed, and Coinbase has said it cannot tell each customer exactly what information was accessed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Potentially exposed | Coinbase said was not exposed |
|---|---|
| Full name | Passwords |
| Residential or mailing address | Two-factor authentication codes |
| Phone number and email address | Private keys |
| Driver’s-license or passport images and other government-ID images | Direct access to customer funds |
| Last four digits of Social Security numbers | Access to Coinbase or customer hot wallets |
| Masked bank-account numbers or incomplete account identifiers | Access to Coinbase or customer cold wallets |
| Account-balance snapshots and transaction history | Coinbase Prime accounts |
| Limited corporate documents, training material and support communications | — |
These distinctions matter. The cited disclosures do not establish that full Social Security numbers were exposed. They also do not establish that every customer’s ID image, balance or transaction history was accessed.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Were Coinbase accounts or customer funds compromised?
Coinbase said the breach did not provide direct access to customer funds, Coinbase wallets or private keys. On the evidence available in its disclosure, this was primarily a personal-data exposure—not a technical compromise that allowed attackers to withdraw assets from Coinbase-held wallets.
That does not make the incident harmless. A criminal who knows a customer’s name, address, identity-verification details, recent transactions or approximate balance can make a fake support call unusually convincing. The attacker may claim there is a suspicious withdrawal, account freeze or compliance problem and pressure the victim to “protect” funds by sending them to a new address.
There are three different situations to separate:
- Direct wallet theft: Coinbase said the breach did not give attackers this access.
- Manipulated customer transfer: A victim may be persuaded to authorize a transfer to a scammer-controlled wallet. Coinbase said eligible retail customers could be voluntarily reimbursed where the loss resulted directly from this incident, subject to review.
- Unrelated Coinbase impersonation: A scam using the Coinbase name is not automatically evidence that the victim’s data came from this breach.
How to recognize a legitimate Coinbase notice
Coinbase said affected customers were emailed from [email protected] with the subject line “Important Notice.” Its current security-incident help page says customers whose information it knows was improperly accessed were notified.
Recommended Free Tools
Do not treat the sender address alone as proof. Email addresses can be spoofed, and a genuine-looking message can contain a malicious link. Instead:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Do not click an unexpected link. Open the Coinbase app or type the official Coinbase address manually.
- Do not call a number supplied in an email, text or phone call.
- Do not provide a password, 2FA code, seed phrase, API key or remote access.
- Never move assets to a “safe” wallet, vault, new address or replacement account because someone contacts you.
- Be suspicious of anyone who cites your balance, recent transaction or identity document as proof they work for Coinbase.
Coinbase says it will not ask for passwords, 2FA codes, seed phrases or transfers to a specified destination. If you are uncertain, lock the account through the official interface and contact Coinbase through its official help system.
What notified customers should do now
1. Secure the Coinbase account
- Sign in only through the official Coinbase app or a manually entered website address.
- Change your Coinbase password if it is reused anywhere else. Make it unique and long.
- Enable strong two-factor authentication. A hardware security key is generally stronger against phishing than SMS where Coinbase supports it.
- Review account activity, withdrawals, authorized devices, sessions, API keys and security settings.
- Remove unfamiliar API keys, devices, sessions and withdrawal destinations.
- Enable withdrawal or address allow-listing if it is available for your account and jurisdiction.
- Consider lowering withdrawal limits or locking the account if anything looks suspicious.
A password manager such as 1Password, Bitwarden or Proton Pass can help create and store a unique password. A security key from Yubico or Google Titan may provide stronger login protection when supported and configured correctly. Neither tool prevents a person from being manipulated into approving a transfer or revealing a seed phrase.
2. Protect against identity theft
If a government-ID image or contact information may have been exposed:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Place a security freeze with Equifax, Experian and TransUnion.
- Consider an initial fraud alert if identity-theft activity is suspected.
- Review credit reports, bank statements and new-account inquiries.
- Watch for tax-related fraud, SIM-swap attempts and changes to phone or mailing-account information.
- Ask your state motor-vehicle agency whether a replacement license or fraud flag is appropriate if a driver’s-license image was exposed.
- Use IdentityTheft.gov to report and recover from suspected identity theft.
A credit freeze is free and can help prevent many new-credit accounts. It does not stop phishing, SIM swapping, tax fraud, takeover of existing accounts or a scammer persuading you to send cryptocurrency.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Replacing an identity document may reduce future misuse, but it cannot erase copies that may already have been obtained. Paid services such as Aura, Norton LifeLock, IdentityForce, Experian IdentityWorks and Allstate Identity Protection may be useful for centralized alerts or recovery assistance. Check current pricing, coverage, exclusions, insurance limits and cancellation terms directly with each provider. Monitoring is not a substitute for a freeze or account security, and no service guarantees crypto recovery.
3. Preserve evidence
Save the Coinbase notice, suspicious emails and texts, phone numbers, caller details, screenshots, claimed explanations, dates and times, wallet addresses and transaction hashes. Do not delete messages before reporting them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you sent cryptocurrency to a scammer
Report the loss promptly through Coinbase’s official account-loss process. Coinbase asks for details including how the scammer contacted you, call information, screenshots, what the scammer claimed, the date and time, and related transactions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also contact your bank or payment provider, report the incident to law enforcement or the relevant fraud-reporting service, and provide transaction hashes. Blockchain transfers are generally difficult or impossible to reverse. Do not pay a person who promises to recover your crypto; recovery scams commonly target people who have already lost funds.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Coinbase’s reimbursement statement was voluntary and fact-dependent. It was directed at eligible retail customers who sent funds to the attackers as a direct result of this incident, subject to a review of the circumstances. It is not an automatic promise to reimburse every loss involving someone pretending to be from Coinbase.
What Coinbase said it would do
Coinbase said it would reimburse eligible incident-related losses, add ID checks and scam-awareness prompts for flagged accounts, monitor high-risk transactions and potentially delay them, open a new U.S. support hub, strengthen support-operation controls and monitoring, and invest more in insider-threat detection and automated response.
Its SEC filing estimated preliminary remediation and voluntary reimbursement costs of $180 million to $400 million. That was an estimate, not the final cost, and Coinbase warned that the financial impact could change as the investigation continued.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat remains unknown
- The precise final global number of affected customers.
- The exact information accessed for each individual.
- The ultimate total cost, reimbursement amount and fund recovery.
- The final status of prosecutions or arrests related to the campaign.
If you did not receive a notice, that indicates Coinbase has no confirmed record that your information was involved, but it is not proof that no information about you exists elsewhere. Continue using ordinary account-security and identity-theft precautions.
Do not confuse this breach with other Coinbase incidents
Coinbase’s July 2026 postmortem described a roughly 50-minute service outage caused by an infrastructure configuration error and said customer funds were not at risk. That was an availability incident, not evidence of another customer-data breach. Similarly, Coinbase has described at least one later impersonation case with no evidence that the customer information came from a Coinbase security breach.
The practical rule is simple: verify every contact through Coinbase’s official app or help system, never disclose authentication secrets, and never transfer funds because an unsolicited caller tells you to.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
