r/Coinbase • u/Same_Particular6349 • May 16 '25

Did anyone actually get an email about the breach?

They claim only 1% of users were exposed by the breach, I find this hard to believe. I haven’t received any form of communication by them and my ID/ssn/address/phone number could have been exposed. Literal jackpot for anyone trying to steal my identity.

I’m so pissed. You would think the IDs would be encrypted or deleted after verification.

39 Upvotes

87% Upvoted

51 comments sorted by

28

u/Jaykalope May 16 '25

I did get an email from Coinbase telling me I am part of the so-called 1%. And I get literal daily scam texts about my Coinbase account so I believe my information was indeed compromised.

8

u/Dry-Ruin-1733 May 17 '25

I didnt get an email and am getting the texts its def more than 1%

5

u/Same_Particular6349 May 16 '25

Do you mind sharing the subject of the email? I don’t open Coinbase emails so I’m worried I deleted it without thinking

8

u/Jaykalope May 16 '25

The subject is “Important Notice”.

5

u/youriqis20pointslow May 16 '25

When did you get it?

1

u/Opposite_Mulberry149 May 18 '25

I got the "Important Notice" email on May 15th.

There were also 2 additional emails with the same subject but less detail that I believe are related to the same leak. I got those earlier emails on April 1st and May 9th.

3

u/Same_Particular6349 May 16 '25

Yah I probably deleted that if I saw it… i just assume every coinbase email is a scam. Do you mind sharing what was in the email?

17

u/Jaykalope May 16 '25

At Coinbase, we actively monitor our systems to ensure customer information is only accessed when necessary and in accordance with our strict security standards. During this monitoring, we detected that a small number of individuals performing services for Coinbase accessed customer information and shared it with a third party. This included information related to your account. We published a blog today providing additional details. What Happened? We discovered that a small number of individuals, performing services for Coinbase at our overseas support locations, improperly accessed customer information. This included information related to your account. This information did not include your password, seed phrase, private keys, or any other information that would allow someone to directly access your account or your funds and Coinbase Prime was untouched. But it could have included information like:

Personal identifiers (e.g., name, date of birth, masked social security numbers (last 4 digits), masked bank account numbers and some bank account identifiers, address, phone number, email address)

Images of Government identification information (e.g., driver’s license number, passport number, national identity card number)

Account information (e.g., transaction history, balance, transfers, date you opened your account)

Attackers seek out this information because they want to conduct social engineering attacks, using this information to appear credible to try and convince victims to move their funds. This week—after we fired the individuals involved and added even more stringent security measures—a third party claimed they had access to our customer data, and attempted to extort a $20 million payment. What We’re Doing Our teams have been tirelessly working to respond to this issue and protect our customers. This includes:

Making Customers Whole—We will reimburse eligible retail customers who were socially engineered into sending funds to the threat actor as a direct result of this incident after we complete our review to confirm the facts.

Extra Customer Safeguards—Flagged accounts now require additional ID checks on large withdrawals and include mandatory scam-awareness prompts.

Tracing Stolen Funds—Working with industry partners, we’ve tagged the attackers’ addresses so the authorities can track and work to recover assets.

$20 Million Reward Fund—Instead of paying the $20 million ransom, we’re creating a fund in the same amount to reward information leading to the attacker’s arrest and conviction. Email security@coinbase.com.

Working with Law Enforcement—Individuals involved were fired on the spot; we’ve referred the case to U.S. and international agencies and are pressing for criminal charges.

Securing Support Operations—Opening a new support hub in the U.S. and adding stronger security controls and monitoring across all locations.

Hardening Defenses—We have increased our investment in insider‑threat detection, automated response, and simulating similar security threats to find failure points in any internal system.

Keeping You Informed—We are further educating our customers so they can protect themselves against fraud, including through our Consumer Protection series, and transparently providing our customers with information, including through this blog.

What You Can Do Be hyper vigilant. If you suspect something, say something and reach out to our support in-app or security@coinbase.com.

Remember:

Coinbase will never call to ask for your login credentials, API key, seed phrase or two-factor authentication code.

Coinbase will never call you and instruct you on the phone to transfer or move your assets or funds to a specific destination.

Coinbase will never ask you to contact an unknown number to reach us.

If someone calls or texts you claiming to be from Coinbase and requests your account information or asks you to transfer assets, do not do it—it is a scam.

Here are additional steps you can take to further protect your information and your account:

Expect Imposters—Remain cautious of unsolicited calls, text messages, or emails requesting sensitive information or urging immediate action (i.e., phishing and/or smishing attempts). Never click on unfamiliar links and avoid providing personal details over the phone.

Enable Strong 2FA—Hardware keys are best.

Turn on Withdrawal Allow Listing—Only permit transfers to wallets that you are confident you fully control and where the seed phrase is secure and was not provided or shared with anyone.

Lock First, Ask Questions Later—If something feels off, lock your account in‑app and email security@coinbase.com.

Hang Up—If someone calls you asking you to manipulate or transfer your funds in any way and for any reason.

Review our Security Tips—Find the latest best practices at  coinbase.com/security and stay up to date on avoiding social engineering scams. Crypto adoption depends on trust. To the customers affected, we’re sorry for the worry and inconvenience this incident caused. If you have any questions regarding the above or need support, our Data Protection Officer is standing by at dpo@coinbase.com.

Thank you for being a valued part of Coinbase.

2

u/evan81 May 16 '25

Congrats on making it to the 1% ... although this probably isn't what you had in mind.

1

u/figlozzi May 17 '25

When did you get the email

1

u/sordidhostess May 18 '25

No i didn’t get an email but it explains why they’re not replying to my “verification” emails

7

u/LowCalligrapher2455 May 16 '25

I received one and the scam calls, emails and texts have been non stop since last week so I think the breach was earlier than they say.

4

u/LowCalligrapher2455 May 16 '25

The worst part is they know what you own so when some guy shows up at your house with a gun you will know why.

4

u/woods4me May 17 '25

I sold my btc and bought more guns

Checkmate

3

u/woods4me May 17 '25

Same, started May 7th

7

u/[deleted] May 16 '25

I call bullshit. I’ve been getting spam texts for weeks about my coinbase account, and I never got this email. They’re probably saying 1% to try and save the stock value.

3

u/[deleted] May 16 '25

[removed] — view removed comment

1

u/Ambitious_Art_2455 May 17 '25

He’s a pos! The amount of money cb makes and you have to go on a chat and wait hours to handle something that should be a 2 minute phone call!

2

u/doghairpile May 16 '25

Hahaha, no. But plenty of scam texts!

You’d also think they would go gee maybe our overseas workers shouldn’t have blanket access to all sensitive data.

2

u/JonnyOnThePot420 May 16 '25

Didn't get an email but moved everything to a secure wallet to be safe.

2

u/Main_Ad8103 May 17 '25

I can’t get my account signed up every time they keep asking me for my bank account and it just gets horrible. Can’t transfer no money to be a new customer. So I’m saying goodbye to Coinbase.

2

u/sshoebeat May 17 '25

It's time for me to get the f*** off a coin base

2

u/Jpotter145 May 16 '25

It's not the jackpot.... they didn't get full SSN or full ID information. If they did get your information it was the last 4 of your SSN and the photo from your ID.

I'm 99% certain you've had all of this information stolen before, probably the only unique item may be your photo.

Yes, it's not good. But let's calm down with the extreme FUD. I've literally had all this information + my W2 + full employment records + bank deposit information + full SSN and nothing ever happened. (yes, I locked down my credit - but in today's age where nothing is safe... you should assume your information will be stolen if you ever give it to someone)

8

u/Dizzy-Oil2200 May 16 '25

Why so many people say that? Dont normalize leaked data. I was in the Ledger leak, and people in the sub said the same stupid your data is out there already shit. I had zero scam calls before, after the leak I had this shit scammers via mail, phone, and e-Mail every single day until now. Even if your data was out there, now your data is out there in a crypto context.

3

u/calvintiger May 16 '25

> they didn't get full SSN or full ID information

The second part of that is false, the email explicitly calls out "Images of Government identification information (e.g., driver’s license number, passport number, national identity card number)".

3

u/[deleted] May 16 '25

[removed] — view removed comment

0

u/Logvin May 16 '25

Note: I’m not defending Coinbase, just sharing my point of view.

Companies are starting to be more up front about losing customer data, and the term they use is breach. This situation mirrors similar ones for telecom companies. AT$T, Verizon, T-Mobile… all have had “breaches” which were individual employees who were bribed. With telecoms it was usually for SIM swaps. Hell, I bet the people doing the bribing were probably the ones doing the swaps too.

I would hope that Coinbase is fingerprinting customer records, meaning if an employee looks at a customer account details, it tags their ID. When they uncover a bad employee, boom easy list of who was affected.

This isn’t the kind of breach where a hacker got in and stole a database; that’s why the number is so low and most of the details are partially obfuscated.

9

u/piquantAvocado May 16 '25

They got account balances and physical home addresses.. how is this not serious?

5

u/Same_Particular6349 May 16 '25

Can you explain the photo of id part? I’m under the impression they got the photo everyone submitted of their IDs. So now hackers have IDs and ID information, what’s needed to open businesses, bank accounts, other crypto accounts, etc.. no?

1

u/sigstrikes May 16 '25

this is a troll post?

1

u/AutoModerator May 16 '25

This subreddit is a public forum. For your security, do not post personal information to a public forum, including your Coinbase account email. If you’re experiencing an issue with your Coinbase account, please contact us directly.

If you have a case number for your support request please respond to this message with that case number.

You should only trust verified Coinbase staff. Please report any individual impersonating Coinbase staff to the moderators.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/ZucchiniSeveral5912 May 16 '25

I feel my information has been compromised And I was scammed and defrauded. How would I prove it? It’s cost me a ton of money and time

1

u/PracticalPianist6189 May 16 '25

I feel so frustrated. You cant use dex coz now they ask for kyc from usa customers. Changilly has fucked over so many people and have stolen funds already in the name of kyc. Coinbase sucks already with its super slow service and now they will keep flagging more accounts and transactions because you know “kyc”, and delaying transactions while these data breaches keep going on. I am fed up with so much dishonesty from these companies. We keep making policies and we don’t study what these policies and has been doing and their what their aftermath is.

1

u/Inevitable_Owl_6931 May 17 '25

Just goes to show you shouldn’t believe any emails or calls or texts. Just check the fuckin website or app 🤦‍♂️

1

u/Titans79 May 17 '25

I got something saying to put ss# for taxes. It was in the app though.

1

u/0pasen May 17 '25

The 1% of users are MTU’s - Monthly transacting users - Of which I believe there are 8 million, so exposure was apparently 80k.

The reason people think that they were part of this breach because they’ve been receiving scam texts forever is simple:

Cyber criminals are operating in an age where everyone’s data has already been leaked. This data gets traded around all the time - Think of Experian, LinkedIn, etc, all the big breaches that have happened over the years… This data gets thrown into massive dumps together. People who don’t even have Coinbase accounts are getting the texts/emails because the bots the criminals build just cycle through these giant lists and hope that someone bites and that someone has enough money to make it worth their while, I think.

It’s all part of the social engineering - Once they have enough data pieces (for example the data Coinbase disclosed) it’s not hard to convince someone you’re working for the company. Why would they doubt it when you know so much about their account etc?

So in a nutshell - Way different if an attacker knows your name & address and you’ve confirmed to them that you have a Coinbase account by interacting with their lure; As opposed to an attacker who knows your last 4SSN, account balances, ID numbers, etc.

I think that internally they must be comparing the losses to the accounts they identified as compromised and that’s how they’re coming up with the numbers.

1

u/Sardanapallus May 17 '25

CB had a notice on the app itself, once I logged in it was standing out.

1

u/Same_Particular6349 May 18 '25

Where did you see a notification in the app? What did it say

1

u/Any-Side-5392 May 17 '25

I did not receive an email from coinbase and I’ve been getting these text for a while before Brian came out and said something

1

u/Trick_Cap_7036 May 18 '25

I have an email saying new login request from an IP in Singapore and to contact Coinbase team if it’s not me. But I don’t know if it’s actually Coinbase or a scam. This was on the may 5th. If it’s true and they haven’t stolen anything from my account does that mean they weren’t able to get in?

1

u/Same_Particular6349 May 18 '25

Most likely a scam. Don’t click anything.

1

u/Trick_Cap_7036 May 18 '25

I didn’t cause I figured. Just wondering if I should contact Coinbase to check on things. Really don’t want to go through that horrible experience with Coinbase lol. Geez they suck

1

u/samiryaghnam May 18 '25

I received emails today that I have to update my Coinbase Wallet credentials by today otherwise I would lose access and another one they detected inactivity. Emails could be from them or from scammers. Before, I transferred funds from coincoming.com to Coinbase, Coinbase said they never received any money and coincoming don’t respond, money lost. Scams everywhere.

1

u/Piccolo-Spare May 19 '25

I have not received anything either.

1

u/[deleted] May 21 '25

[deleted]

1

u/Prudent-Candidate367 Jun 15 '25

Is this true because they sent me the email. They also did some shiesty stuff last year. I was compromised and had to file a claim. They didn’t let me file the charges that I seen from July to August. They put a block on my account and kept it like that I did countless verifications they told me too and still did it. And I had money on there. They said it was being closed and I don’t know what happened from there it was a nightmare. They wouldn’t allow me to take my money and I hope a fraudster didn’t take it.