Coinbase is now facing mounting scrutiny after it allegedly sat on a serious data breach for over four months, exposing the personal information of nearly 70,000 users before taking action.
The breach, which reportedly began with insiders at an overseas customer support center leaking sensitive data, was discovered in January 2025. However, users and regulators were not informed until May. The compromised data included partial Social Security numbers, home addresses, and account activity tied to support tickets.
The vendor at the center of the leak, TaskUs, is said to have had staff in India who accepted bribes in exchange for screenshots of Coinbase customer information. The exchange has since cut ties with the firm and is reportedly implementing stricter oversight of all third-party partners.
Coinbase now estimates the incident could cost up to $400 million in legal and remediation expenses. Meanwhile, a class-action lawsuit accuses the company of withholding critical information that might have affected its stock performance. A separate case has been filed against TaskUs for negligence.
By March, the stolen data had surfaced in Telegram groups known for crypto fraud, with attackers eventually attempting to extort $20 million from Coinbase in exchange for deleting the files. The company refused and instead offered the same amount as a bounty for leads on the culprits.
Regulatory agencies are now investigating whether Coinbase’s failure to disclose the breach sooner violated SEC rules for public companies.
An extensive international cybercrime network has been brought down after law enforcement seized 145 domains linked to BidenCash, a notorious online marketplace that thrived on trading stolen credit card data and compromised digital identities.
Hackers in the crypto world are changing course, moving away from exploiting smart contracts and turning their focus toward tricking users directly.
A major security lapse has rocked Taiwan-based crypto exchange BitoPro, which quietly suffered an $11.5 million hack earlier in May but failed to alert users for weeks.
A Nevada resident has been sentenced to six years in federal prison after orchestrating a sophisticated fraud operation that involved stealing U.S. Treasury checks and using stolen identities to access the funds.