Earlier this year, Coinbase disclosed a security breach affecting customer data. But newly surfaced details raise serious questions about the exchange’s transparency and the timeline of its disclosure.
The Coinbase customer breach that involved the leak of sensitive user data including customer names, IDs, phone numbers, addresses, and more, has raised security questions across the industry. The exchange revealed the incident on May 15, 2025, adding that the attackers had attempted a $20 million ransom-style extortion.
However, Reuters reports suggest that the exchange learned of the breach much earlier in the year, as far back as January. Coinbase previously admitted in its May SEC filing that it learned of accessed employee data “in previous months” but failed to grasp the full extent of the threat until it received the extortion demand from the cybercriminals.
As the events progressed, the true extent of the coordinated scheme became clear.
Coinbase customer data breach ties to insider operation
The breach reportedly began with an India-based employee of TaskUs, a U.S. outsourcing firm. According to former employees of the firm, the employee was caught photographing customer data from her work computer using her personal device. Along with a suspected accomplice, she allegedly sold sensitive Coinbase user information to malicious actors in exchange for payment.
TaskUs reportedly confirmed that two employees, along another 200, were terminated for unauthorized data access, adding that the incident was part of a “broader, coordinated criminal campaign.”
While Coinbase has since cut ties with the involved personnel and implemented tighter controls, the revelation has sparked fresh questions about why the exchange waited until mid-May to formally disclose the breach, particularly given the potential financial and reputational fallout.
Security breaches have long remained a threat to the crypto industry, with malicious actors constantly lurking in the shadows to prey on unsuspecting victims. In May alone, hacks and exploits led to an estimated $244.1 million in losses, highlighting the high stakes involved in such incidents.
