Loading story…
Coinbase confirmed an insider data breach in which a single contractor improperly accessed customer information affecting approximately 30 customers. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and identity theft protection was offered; Coinbase also reported the incident to relevant regulators.
The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal Coinbase support interface that appeared to expose access to sensitive customer data, including names, email addresses, phone numbers, dates of birth, and KYC information (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is separate from the previously disclosed TaskUs-related insider breach, and it remains unclear whether the group that posted the screenshots (reported as “Scattered Lapsus Hunters”) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of BPO/contractor ecosystems due to their privileged access to internal tools and customer records.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Coinbase publicly confirmed the insider-related data access incident in early February 2026, linking it to the leaked support tool screenshots and stating that the breach affected about 30 customers. The company emphasized that the incident was separate from the earlier TaskUs-associated breach.
Before Coinbase publicly confirmed the incident, a threat actor cluster calling itself 'Scattered Lapsus Hunters' briefly posted and then deleted screenshots on Telegram showing an internal Coinbase support interface with access to sensitive customer data. It remained unclear whether the group conducted the breach or only obtained the leaked material.
After detecting the incident, Coinbase notified impacted customers and offered identity theft protection. The company said roughly 30 users were affected.
Coinbase's security team detected the unauthorized access during 2025, determined it was an insider-related incident, and removed the contractor from providing services. The company said the event was separate from the previously disclosed TaskUs-related insider breach.
In December 2025, a contractor improperly accessed Coinbase customer information affecting approximately 30 users. The exposed data included personal details such as names, email addresses, phone numbers, and KYC information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A former Coinbase customer service agent was arrested in Hyderabad, India, for assisting hackers in stealing sensitive customer data from the cryptocurrency exchange. The breach, which occurred earlier in the year, involved hackers bribing employees of TaskUs, a customer support outsourcing firm, to gain unauthorized access to Coinbase's systems. The attackers demanded a $20 million ransom to prevent the publication of the stolen data, which included names, dates of birth, partial Social Security numbers, addresses, phone numbers, email addresses, and, for some, scanned KYC documents. Coinbase reported that approximately 69,500 customers were affected by the breach, and the company responded by shutting down the implicated TaskUs department and cooperating with law enforcement. The arrest of the former agent highlights the ongoing risk of insider threats within organizations, particularly those handling sensitive financial data. Coinbase CEO Brian Armstrong confirmed the arrest and indicated that further detentions may follow as the investigation continues. The incident also drew attention to the delayed disclosure of the breach and the subsequent layoffs at TaskUs. This case underscores the importance of robust insider threat detection and the risks associated with third-party service providers in the financial sector.
Jun 29, 2026
A security researcher, Jonathan Clark, has publicly challenged Coinbase's official timeline regarding a major data breach that exposed sensitive information of nearly 70,000 customers. Clark claims he was targeted by scammers on January 7, 2025, who possessed detailed personal and financial information that should have only been accessible through Coinbase, including his Social Security number and exact Bitcoin balance. He immediately reported the incident to Coinbase, receiving an initial acknowledgment from the company's Head of Trust & Safety, but received no further response despite multiple follow-ups. Coinbase later disclosed to the US Securities and Exchange Commission in May 2025 that the breach occurred on December 26, 2024, but was not discovered until May 11, 2025, when attackers attempted to extort the company for $20 million. Clark disputes this timeline, providing emails and call records as evidence that the breach was known to Coinbase months before their public disclosure. The incident raises serious questions about Coinbase's breach notification practices and the security of customer data.
Jul 12, 2026
**Betterment** disclosed that a **social engineering** attack against a **third-party platform account** used for customer communications enabled unauthorized access to internal systems in early January, leading to the exposure of personal data tied to **1,435,174 accounts**. The intruder used the access to send **fraudulent crypto-themed promotional messages** impersonating Betterment and promising to “triple” cryptocurrency sent to attacker-controlled wallets (including **Bitcoin and Ethereum** addresses). Betterment said it revoked the unauthorized access the same day it was detected, warned customers to ignore the messages, and initiated a forensic investigation with external incident-response support. Breach analysis and indexing by **Have I Been Pwned** indicated the exposed dataset included **email addresses, names, and location data**, with reporting also citing additional PII such as **dates of birth, physical addresses, phone numbers, device information, and employment-related details**. Betterment stated there is **no evidence** that customer investment accounts were accessed or that **passwords/authentication tokens** were compromised, characterizing the incident as an exposure of contact/identity data rather than account credentials. Separate reporting noted Betterment also experienced **intermittent outages attributed to a DDoS attack and extortion attempts** around the same period, but this was described as distinct from the social-engineering-driven data exposure.
Jun 29, 2026