MisuseFinancial ServicesTechnologyFinancePrivilege AbusePhishingRansom DemandedData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountPIIHighContained

COINBASE, INC.

bd_7388d192de2195c0 · schema v1 · pii pii-v1

Severity

High

Discovered

May 11, 2025

Filed

May 20, 2025

To disclose

9 days

Affected

3,337state residents only

Linked

10 filings

Confidence

70%

Full breach record for COINBASE, INC. →4 incidents on file

Coinbase, Inc. reported an insider threat incident where individuals performing services at overseas retail support locations improperly accessed customer data, including PII and financial identifiers. The breach occurred between Dec 26, 2024, and May 5, 2025. A third party attempted to extort $20M. Coinbase fired the insiders, engaged law enforcement, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d9 days discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

undetected · 136 days

discovery → filing · 9 days

Dec 26, 2024

Begins

May 11, 2025

Discovered

May 20, 2025

Filed

vs. sector median

7 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_2406100bb1153d9e2025-05-20Verified
Montana State AGbd_6fcf4d20742c3a722025-05-20Verified
Maine State AGbd_b45c155746e8d50c2025-05-20Verified
Massachusetts State AGbd_fa2703e77095dfa82025-05-20Verified

Show 5 more filings ↓up to 19d gap

SEC 8-Kbd_6b9a0642ea872c252025-05-15 · +5dCandidate
New Hampshire State AGbd_bc2dd2c7c34bf3fe2025-05-27 · +7dVerified
Indiana State AGbd_a3874b13126e95f92025-05-30 · +10dVerified
Nebraska State AGbd_eb31106dc74935862025-05-30 · +10dVerified
Illinois State AGbd_a0715ceb81713b592025-05-01 · +19dCandidate

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com
Industry: Financial ServicesllmTechnologyllm

Discovered: May 11, 2025
Breach occurred: Dec 26, 2024 – May 5, 2025
Undetected for: 136 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 11, 2025
Affected individuals: 3,337state-resident count only
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: NameDriver's licence numberDate of birthPassport numberSocial Security number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: InternalFinancial
Regulator citations: Referred the case to U.S. and international agencies
Initial access: insider_action

During the incident: Fired the individuals involved
Referred the case to U.S. and international agencies
Pressed for criminal charges
Opened a new support hub in the U.S.
Added stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Deployed automated response
Simulated similar security threats to find failure points
Offering free one-year credit monitoring and identity protection services provided by IDX
Flagged accounts now require additional ID checks on large withdrawals
Added mandatory scam-awareness prompts
Changes made: Opening a new support hub in the U.S.
Adding stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Deployed automated response
Simulating similar security threats to find failure points in any internal system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Illinois State AGMay 1 · first

SEC 8-K+14d

California State AG+19d

Montana State AG+19d

Maine State AG+19d

Massachusetts State AG+19d

Washington State AG+19d · this page

New Hampshire State AG+26d

Indiana State AG+29d

Nebraska State AG+29d

Pattern: first filing May 1 (IL), last May 30 (NE) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33375.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2025
Raw hash: 4cf6845a1febaca002fd054cf617e573e1dff6abb9dce1e17cf322a630d946d4

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCOINBASE, INC.

Victim entityCOINBASE, INC.

Incidentdiscovered May 11, 2025

Stated responseFired the individuals involved

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com