HackingFinancial ServicesTechnologyFinanceStolen CredentialsPhishingCustomer Data InvolvedData ExfiltratedMulti-Stage ChainIdentity (basic)Financial accountCredentialsLocationBehaviorMediumContained

COINBASE, INC.

bd_b312e90e0503e80c · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 27, 2021

To disclose

—

Affected

6,000

Linked

4 filings

Confidence

66%

Full breach record for COINBASE, INC. →4 incidents on file

Coinbase, Inc. disclosed that between March and May 20, 2021, unauthorized third parties accessed at least 6,000 customer accounts. Attackers used compromised credentials (email, password, phone) obtained via phishing/social engineering and exploited a flaw in Coinbase's SMS Account Recovery process to bypass two-factor authentication. Funds were transferred to external crypto wallets. Coinbase reimbursed affected customers, updated recovery protocols, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 1, 2021

Begins

Sep 27, 2021

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_6106f156a9b2a0972021-09-27Verified
Montana State AGbd_72c7989c67aa78df2021-10-07 · +10dVerified
Massachusetts State AGbd_ab7cb7d82e3a889b2021-10-13 · +16dVerified

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Breach occurred: Mar 1, 2021 – May 20, 2021
Materiality determined: —
Notification sent: Sep 24, 2021
Affected individuals: 6,000nationwide
Data types: Identity (basic)Financial accountCredentialsLocationBehavior
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Working closely with law enforcement to support its investigation
Initial access: phishing_link

During the incident: Updated SMS Account Recovery protocols to prevent any further bypassing of that authentication process
Depositing funds into your account equal to the value of the currency improperly removed
Setting up a dedicated phone support line for our customers who have been impacted
Providing free credit monitoring to affected customers
Working closely with law enforcement to support its investigation
Working to restore any changed emails or phone numbers to their original state
Changes made: Encouraging customers to use stronger methods of securing accounts such as time-based one-time password (TOTP) or a hardware security key
Encouraging customers to change the password on their Coinbase account to a new, strong and unique password
Encouraging customers to change passwords for email accounts and other online accounts
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 27 · first

California State AGSep 27 · first · this page

Montana State AG+10d

Massachusetts State AG+16d

Pattern: first filing Sep 27 (IN), last Oct 13 (MA) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-545815
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2021
Raw hash: 77143cdf5e57e0d13c0874755568fe241f4b1b851429a22ba7bc212ff4b4e0e6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCOINBASE, INC.

Victim entityCOINBASE, INC.

IncidentUnauthorized Access

Stated responseUpdated SMS Account Recovery protocols to prevent any further bypassing of that authentication process

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov