CoinTracker cointracker.io CoinTracker data breach: what happened and what to do
In December 2022, CoinTracker customers' email addresses were exposed in a breach at email provider SendGrid. Have I Been Pwned lists 1,557,153 accounts. CoinTracker said it found no breach of its own database.
View all 13,115 breaches- Breach date
- Dec 2022
- Affected
- 1,557,153
- Data exposed
- Email addresses, Partial phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
CoinTracker, a crypto and NFT tax service, reported a data breach in December 2022. The company said the exposure came from a breach of its email provider, SendGrid, and that it found no breach of its own database. It attributed the SendGrid incident to a Twilio employee whose corporate credentials were exposed. CoinTracker emailed affected users as soon as it learned of the incident.
Have I Been Pwned lists 1,557,153 affected accounts. The exposed data includes email addresses and partially redacted phone numbers. CoinTracker said the leak appears to be email addresses only, and that the phone numbers did not come from its service. No financial data was exposed, according to CoinTracker.
An email address that's tied to a crypto tax service tells a scammer you probably hold crypto, which makes you a target for fake support messages and wallet phishing. Never enter a seed phrase anywhere, and treat any message asking for one as a scam.
If you got an email from CoinTracker about this, it was real, but be careful with any follow-up message that asks you to click a link. Check the company's blog post directly and log in through the app or the official site only.
What to do if you were in it
- 1
Expect crypto-themed phishing
Ignore emails or texts that claim to be CoinTracker, an exchange or a wallet and ask you to log in, verify or connect a wallet. Go to the site yourself instead.
- 2
Never share a seed phrase
No real company will ask for your recovery phrase. Anyone who asks for it is trying to empty your wallet.
- 3
Turn on two-factor authentication
Use an authenticator app or a security key on your CoinTracker, exchange and email accounts, not just SMS codes.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in breach databases and the dark web and tells you what to do about each hit. Serus can't pull breach data back, but it alerts you when your details turn up.
Frequently asked
Was I affected by the CoinTracker breach?
Have I Been Pwned lists about 1.5 million email addresses. Search yours there or run a free Serus scan.
What was exposed in the CoinTracker breach?
Email addresses and partially redacted phone numbers, according to Have I Been Pwned. CoinTracker said the phone numbers did not come from its service and no financial data was exposed.
Should I change my password?
CoinTracker said its own database wasn't breached, so passwords weren't the issue. Changing it is still cheap, and do it anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
