Loading story…
A security researcher, Jonathan Clark, has publicly challenged Coinbase's official timeline regarding a major data breach that exposed sensitive information of nearly 70,000 customers. Clark claims he was targeted by scammers on January 7, 2025, who possessed detailed personal and financial information that should have only been accessible through Coinbase, including his Social Security number and exact Bitcoin balance. He immediately reported the incident to Coinbase, receiving an initial acknowledgment from the company's Head of Trust & Safety, but received no further response despite multiple follow-ups.
Coinbase later disclosed to the US Securities and Exchange Commission in May 2025 that the breach occurred on December 26, 2024, but was not discovered until May 11, 2025, when attackers attempted to extort the company for $20 million. Clark disputes this timeline, providing emails and call records as evidence that the breach was known to Coinbase months before their public disclosure. The incident raises serious questions about Coinbase's breach notification practices and the security of customer data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Register covered the researcher's claims that Coinbase's breach disclosure timeline was inaccurate, amplifying allegations that the attack activity predated the company's stated discovery date by months. The article did not add a separate confirmed incident date beyond the dispute itself.
A security researcher published recordings and emails alleging that attacks tied to the Coinbase breach started months before the company's stated discovery timeline. The report challenges Coinbase's public account of when the incident began.
2 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcejonathanclark.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coinbase confirmed an **insider data breach** in which a single contractor improperly accessed customer information affecting approximately **30 customers**. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and **identity theft protection** was offered; Coinbase also reported the incident to relevant regulators. The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal **Coinbase support interface** that appeared to expose access to sensitive customer data, including **names, email addresses, phone numbers, dates of birth, and KYC information** (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is **separate from the previously disclosed TaskUs-related insider breach**, and it remains unclear whether the group that posted the screenshots (reported as **“Scattered Lapsus Hunters”**) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of **BPO/contractor ecosystems** due to their privileged access to internal tools and customer records.
Jun 29, 2026
A former Coinbase customer service agent was arrested in Hyderabad, India, for assisting hackers in stealing sensitive customer data from the cryptocurrency exchange. The breach, which occurred earlier in the year, involved hackers bribing employees of TaskUs, a customer support outsourcing firm, to gain unauthorized access to Coinbase's systems. The attackers demanded a $20 million ransom to prevent the publication of the stolen data, which included names, dates of birth, partial Social Security numbers, addresses, phone numbers, email addresses, and, for some, scanned KYC documents. Coinbase reported that approximately 69,500 customers were affected by the breach, and the company responded by shutting down the implicated TaskUs department and cooperating with law enforcement. The arrest of the former agent highlights the ongoing risk of insider threats within organizations, particularly those handling sensitive financial data. Coinbase CEO Brian Armstrong confirmed the arrest and indicated that further detentions may follow as the investigation continues. The incident also drew attention to the delayed disclosure of the breach and the subsequent layoffs at TaskUs. This case underscores the importance of robust insider threat detection and the risks associated with third-party service providers in the financial sector.
Jun 29, 2026
Several organizations disclosed data breaches affecting user and customer information, with incidents spanning different industries and timeframes. The Botting Network, a now-defunct forum focused on botting, suffered a breach in August 2012 that exposed 96,000 user records, including email addresses, usernames, dates of birth, and salted MD5 password hashes. Web Hosting Talk, a vBulletin-based forum, experienced a breach in July 2016, resulting in the exposure of 515,000 user records containing usernames, email addresses, IP addresses, and salted MD5 password hashes. Both breaches were added to public breach notification services in December 2025. In a separate incident, AUTOSUR, a French vehicle inspection company, reported a breach in March 2025 that compromised over 10 million customer records, with 487,000 unique email addresses exposed alongside names, phone numbers, physical addresses, and detailed vehicle information. Additionally, Vocatura, Spagnuolo & Company, a Massachusetts-based accounting firm, disclosed a breach involving unauthorized access to a single email account, potentially exposing sensitive personal information of over 980 individuals. The exact data types affected in the Vocatura breach have not been publicly specified as of the latest disclosure.
Jul 12, 2026