MisuseFinancial ServicesTechnologyFinancePrivilege AbuseBECRansom DemandedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPIIMediumContained

COINBASE, INC.

bd_6fcf4d20742c3a72 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 20, 2025

To disclose

—

Affected

160state residents only

Linked

10 filings

Confidence

67%

Full breach record for COINBASE, INC. →4 incidents on file

Coinbase Inc. disclosed that a small number of individuals performing services for Coinbase at overseas retail support locations improperly accessed customer information. The incident involved insider misuse of valid accounts to collect PII (names, DOB, masked SSNs, IDs) and account data. A third party subsequently attempted to extort $20 million. Coinbase fired the insiders, engaged law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

May 20, 2025

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_2406100bb1153d9e2025-05-20Verified
Washington State AGbd_7388d192de2195c02025-05-20Verified
Maine State AGbd_b45c155746e8d50c2025-05-20Verified
Massachusetts State AGbd_fa2703e77095dfa82025-05-20Verified

Show 5 more filings ↓up to 19d gap

SEC 8-Kbd_6b9a0642ea872c252025-05-15 · +5dCandidate
New Hampshire State AGbd_bc2dd2c7c34bf3fe2025-05-27 · +7dVerified
Indiana State AGbd_a3874b13126e95f92025-05-30 · +10dVerified
Nebraska State AGbd_eb31106dc74935862025-05-30 · +10dVerified
Illinois State AGbd_a0715ceb81713b592025-05-01 · +19dCandidate

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 160state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: InternalFinancial
Regulator citations: Referred the case to U.S. and international agencies
Initial access: insider_action

During the incident: Fired the individuals involved on the spot
Referred the case to U.S. and international agencies
Pressed for criminal charges
Opened a new support hub in the U.S.
Added stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Deployed automated response
Simulated similar security threats to find failure points
Offering free one-year credit monitoring and identity protection services provided by IDX
Created a $20 million reward fund for information leading to the attacker's arrest and conviction
Changes made: Flagged accounts now require additional ID checks on large withdrawals
Flagged accounts include mandatory scam-awareness prompts
Opened a new support hub in the U.S.
Added stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Deployed automated response
Simulated similar security threats to find failure points in any internal system
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Illinois State AGMay 1 · first

SEC 8-K+14d

California State AG+19d

Washington State AG+19d

Maine State AG+19d

Massachusetts State AG+19d

Montana State AG+19d · this page

New Hampshire State AG+26d

Indiana State AG+29d

Nebraska State AG+29d

Pattern: first filing May 1 (IL), last May 30 (NE) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/12/Consumer-notification-letter-8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2025
Raw hash: b06615dad81094ee60c11015359c19e045efce2b09deeaf37f800ffe32b559cd

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCOINBASE, INC.

Victim entityCOINBASE, INC.

IncidentInsider

Stated responseFired the individuals involved on the spot

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov