Coinbase, one of the world’s largest cryptocurrency exchanges, has confirmed a major cybersecurity breach that compromised the personal data of nearly 70,000 customers. The incident, made public last month, stemmed from insider misconduct at an outsourcing firm, raising alarm over growing threats posed by rogue insiders within the crypto sector.
Contractor Misconduct and Timeline of the Breach
According to Coinbase’s SEC filing, the breach originated at TaskUs, a Texas-based outsourcing company whose contractors in India were bribed to exfiltrate customer data. The breach is believed to have started in December 2024, when TaskUs employees began capturing photos of sensitive information. Coinbase’s internal systems flagged suspicious activity in January, but the company did not publicly disclose the incident until May 14, three days after receiving a ransom demand for $20 million from the attackers.
More than 200 TaskUs employees were ultimately terminated. Coinbase has since severed its relationship with the vendor and expanded internal controls to prevent further insider abuse.
Scope of Data Exposure and Company Response
The stolen data reportedly includes customer names, addresses, masked bank account details, partial Social Security numbers, government-issued ID images, and transaction histories. Coinbase emphasized that the breach did not expose passwords, private keys, or other credentials that could grant direct access to funds.
After detecting unauthorized data access by support personnel, Coinbase promptly terminated those involved, notified affected customers, and implemented new fraud-monitoring mechanisms. In a public statement, the company confirmed it did not pay the ransom and instead offered a $20 million reward for information leading to the perpetrators’ arrest. Affected users have been offered free credit monitoring, identity theft protection, and reimbursement for verified losses linked to the breach.
Legal Fallout and Industry Implications
The breach has triggered investigations by both U.S. and international regulators, including U.S. attorneys general and the UK’s Financial Conduct Authority. It has also added weight to an ongoing class action lawsuit over Coinbase’s biometric data collection practices under Illinois’ Biometric Information Privacy Act (BIPA).
Following the public disclosure, Coinbase shares dropped 7.2 percent on May 15. The company has estimated its breach-related remediation costs could range from $180 million to $400 million.
The incident has reinforced concerns about data security in the cryptocurrency sector. Although exchanges have been adopting tools like behavioral biometrics and advanced authentication systems, insider threats facilitated by bribery represent a growing challenge. As regulators increase scrutiny, the breach may become a defining case for how crypto platforms are expected to secure user data under global data privacy frameworks, including the GDPR.
Coinbase has stated it is cooperating fully with law enforcement and remains committed to strengthening its security protocols in the wake of the breach.
Sources: Top Class Actions, DigWatch, PR Newswire
—
June 5, 2025 – by Ali Nassar-Smith
