FEDERALItem 1.05 · mandatoryMisuseFinancial ServicesTechnologyFinancePrivilege AbuseData MishandlingData ExfiltratedRansom DemandedCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainTargetedPIIGovernment IDFinancial accountFinancialCriticalContained

COINBASE, INC.

bd_6b9a0642ea872c25 · schema v1 · pii pii-v1

Severity

Critical

Financial impact

$290.00M

Discovered

—

Filed

May 15, 2025

To disclose

—

Affected

Not disclosed

Linked

10 filings

Confidence

87%

Full breach record for COINBASE, INC. →4 incidents on file

Coinbase, Inc. disclosed a material incident (Item 1.05) filed May 15, 2025. Overseas contractors/employees were bribed to exfiltrate customer and internal data. Compromised data: names, addresses, masked SSNs, masked bank accounts, government IDs, transaction history. No passwords, private keys, or fund access. Coinbase refused extortion demand and cooperated with law enforcement. Estimated remediation/reimbursement costs: $180M-$400M.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined May 14, 2025 → Filed May 15, 20251d ✓ SEC 4-day OK

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline — partial

? — ?

Breach window unknown

May 15, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_2406100bb1153d9e2025-05-20 · +5dVerified
Montana State AGbd_6fcf4d20742c3a722025-05-20 · +5dVerified
Washington State AGbd_7388d192de2195c02025-05-20 · +5dVerified
Maine State AGbd_b45c155746e8d50c2025-05-20 · +5dVerified

Show 5 more filings ↓up to 15d gap

Massachusetts State AGbd_fa2703e77095dfa82025-05-20 · +5dVerified
New Hampshire State AGbd_bc2dd2c7c34bf3fe2025-05-27 · +12dVerified
Illinois State AGbd_a0715ceb81713b592025-05-01 · +14dCandidate
Indiana State AGbd_a3874b13126e95f92025-05-30 · +15dVerified
Nebraska State AGbd_eb31106dc74935862025-05-30 · +15dVerified

Name: COINBASE, INC.
norm: coinbase
SEC CIK: 0001679788
Domain: coinbase.com
Industry: Cryptocurrency Exchange

Name: COINBASE, INC.
norm: coinbase
SEC CIK: 0001679788
Domain: coinbase.com
Industry: Cryptocurrency Exchange
Also named: Coinbase Global, Inc.operating subsidiary ofholding company
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Materiality determined: May 14, 2025
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIGovernment IDFinancial accountFinancial
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1074 Data StagedT1041 Exfiltration Over C2 Channel
Threat actor: MultipleFinancial
Regulator citations: cooperating with law enforcement
Initial access: insider_action

During the incident: Assessed threat actor email as credible
Declined to pay threat actor demand
Cooperating with law enforcement
Reviewing and bolstering anti-fraud protections
Intends to voluntarily reimburse eligible retail customers who sent funds to threat actor
Changes made: Terminated personnel involved in improper data access
Implemented heightened fraud-monitoring protections
Warned customers whose information was potentially accessed
Opening a new support hub in the United States
Taking additional measures to harden defenses
Source: Quoted from the filing itself, not independently verified.

Compliance flags: SEC 4-day OK · 1d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: May 14, 2025
→ Filed: May 15, 2025
1d cal. 4 business days SEC 4-day OK

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: May 14, 2025 → Filed: May 15, 2025	1d cal.	4 business days	SEC 4-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Illinois State AGMay 1 · first

SEC 8-K+14d · this page

California State AG+19d

Montana State AG+19d

Washington State AG+19d

Maine State AG+19d

Massachusetts State AG+19d

New Hampshire State AG+26d

Indiana State AG+29d

Nebraska State AG+29d

Pattern: first filing May 1 (IL), last May 30 (NE) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 15, 2025
Raw hash: 840c316bd619fe46fd3d0635f17d9102c0243a3b34cb98ce1402713aa41de19b

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html36.7 KB

Download View at source

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCOINBASE, INC.

Victim entityCOINBASE, INC.

IncidentInsider

Stated responseAssessed threat actor email as credible

ComplianceSEC 4-day OK

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing