Coinbase coinbase.com Coinbase data breach: what happened and what to do
In May 2025 Coinbase said criminals bribed overseas support staff to copy customer data, then demanded $20 million. Names, contact details, the last 4 digits of Social Security numbers, masked bank details and ID images were exposed for under 1% of users. Passwords and funds were not.
View all 13,115 breaches- Breach date
- 11 May 2025
- Made public
- 15 May 2025
- Data exposed
- Names, Email addresses, Phone numbers, Physical addresses, Government issued IDs
- Last updated
What happened
On May 11, 2025, Coinbase received an email from someone claiming to hold customer and internal data and demanding money to keep it quiet. Coinbase said it would not pay. On May 15 it disclosed the incident in a filing with the US Securities and Exchange Commission and on its own blog.
The company said criminals had bribed and recruited a group of overseas support agents to copy customer information out of internal support tools those agents were allowed to use. Coinbase said it was working with law enforcement and set up a $20 million reward fund for information leading to the arrest and conviction of those responsible, the same amount as the ransom it refused.
Coinbase said the affected customers made up less than 1% of its monthly users. It has not published a total count of people affected, and state breach filings only show the residents of one state, so there is no reliable overall figure to quote here.
What was exposed
According to Coinbase, the stolen information included:
- Names, addresses, phone numbers and email addresses
- The last 4 digits of Social Security numbers
- Bank account information
- Images of government IDs such as driver's licenses and passports
Press coverage of the filing reports that passwords, private keys and customer funds were not exposed.
What that lets criminals do
The combination matters more than any single item. A name, a phone number and the last 4 digits of a Social Security number are exactly what a scammer needs to sound like a real Coinbase support agent. Coinbase said the stolen data was meant to power social engineering attacks, where a caller or sender poses as the company to trick you into handing over money or access.
ID images are the other concern. A photo of a driver's license or passport can help someone try to open accounts in your name or pass a weak identity check, and unlike a password you can't change it overnight.
What Coinbase did
Coinbase said it would reimburse customers who were tricked into sending funds to the attacker as a direct result of the incident. Its notice letters offered affected customers free credit monitoring and identity protection for one year. In its SEC filing, Coinbase gave a preliminary cost estimate of $180 million to $400 million.
Where Serus fits
Breach data can't be pulled back once it is out. What you can do is find out quickly if your details are circulating and cut down the other places they sit. Serus monitors breach databases and the dark web and alerts you when your email or phone number turns up, and it removes your exposed data from the data brokers and people-search sites that give scammers the extra details they use to sound convincing.
What to do if you were in it
- 1
Treat any Coinbase call, text or email as suspect
Never move funds to a wallet someone gives you, and never share a 2FA code or install remote access software for a caller. If someone contacts you first, hang up and open the Coinbase app yourself.
- 2
Freeze your credit
The last 4 digits of your Social Security number and a photo of your ID are enough to help someone attempt fraud. Freeze your file for free at Equifax, Experian and TransUnion.
- 3
Use a strong 2FA method on Coinbase
Switch from SMS codes to a security key or authenticator app, and set up the withdrawal allowlist so funds can only go to addresses you approved.
- 4
Watch your bank and credit reports
Check the bank accounts linked to Coinbase and pull your free credit reports at annualcreditreport.com for accounts you don't recognize.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your details show up and get alerted if they appear again.
Frequently asked
Was I affected by the Coinbase data breach?
Coinbase said it contacted the customers whose data was taken, which it put at under 1% of monthly users. If you did not get a notice, you are less likely to be affected, but you should still treat unexpected Coinbase contact as a scam.
What was exposed in the Coinbase breach?
Names, addresses, phone numbers, email addresses, the last 4 digits of Social Security numbers, bank account information and images of government IDs, according to coverage of Coinbase's disclosure. Passwords, private keys and customer funds were reported as not exposed.
Do I need to change my Coinbase password?
Coverage of Coinbase's disclosure says passwords were not taken, so the breach itself does not force a change. It is still a good moment to use a unique password and switch to app or key based two-factor login.
Will Coinbase reimburse me if I was scammed?
Coinbase said it would reimburse customers who were tricked into sending funds to the attacker as a direct result of the incident. Contact Coinbase support through the app if that happened to you.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
