MisuseFinancial ServicesTechnologyFinancePrivilege AbuseRansom DemandedData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

COINBASE, INC.

bd_eb31106dc7493586 · schema v1 · pii pii-v2

Severity

Medium

Discovered

—

Filed

May 30, 2025

To disclose

—

Affected

Not disclosed

Linked

10 filings

Confidence

67%

Full breach record for COINBASE, INC. →4 incidents on file

Coinbase Inc disclosed a data breach involving insider threat actors at overseas retail support locations who improperly accessed customer information. The incident involved the exfiltration of personal identifiers, government ID images, and account data. A third party attempted to extort $20 million; Coinbase refused payment, established a $20M reward fund, fired the insiders, and notified affected individuals via state AG filings. No passwords or private keys were compromised.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

May 30, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_a3874b13126e95f92025-05-30Verified
New Hampshire State AGbd_bc2dd2c7c34bf3fe2025-05-27 · +3dVerified
California State AGbd_2406100bb1153d9e2025-05-20 · +10dVerified
Montana State AGbd_6fcf4d20742c3a722025-05-20 · +10dVerified

Show 5 more filings ↓up to 29d gap

Washington State AGbd_7388d192de2195c02025-05-20 · +10dVerified
Maine State AGbd_b45c155746e8d50c2025-05-20 · +10dVerified
Massachusetts State AGbd_fa2703e77095dfa82025-05-20 · +10dVerified
SEC 8-Kbd_6b9a0642ea872c252025-05-15 · +15dCandidate
Illinois State AGbd_a0715ceb81713b592025-05-01 · +29dCandidate

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalFinancial
Regulator citations: Referred the case to U.S. and international agencies
Initial access: insider_action

During the incident: Fired the individuals involved
Created a $20 Million Reward Fund instead of paying ransom
Referred the case to U.S. and international agencies
Pressed for criminal charges
Opened a new support hub in the U.S.
Added stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Simulated similar security threats to find failure points
Offered free one-year credit monitoring and identity protection services provided by IDX
Flagged accounts to require additional ID checks on large withdrawals
Added mandatory scam-awareness prompts
Changes made: Opened a new support hub in the U.S.
Added stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Simulated similar security threats to find failure points in any internal system
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Illinois State AGMay 1 · first

SEC 8-K+14d

California State AG+19d

Montana State AG+19d

Washington State AG+19d

Maine State AG+19d

Massachusetts State AG+19d

New Hampshire State AG+26d

Indiana State AG+29d

Nebraska State AG+29d · this page

Pattern: first filing May 1 (IL), last May 30 (NE) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/0c8ecf69-bde1-4061-8f84-46fd5a48dbe4.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 30, 2025
Raw hash: 67260438a41374a06bce1e0639bc432e698740925155e5c18ee615bb6c9596e2

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCOINBASE, INC.

Victim entityCOINBASE, INC.

IncidentInsider

Stated responseFired the individuals involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov