{"investigation":{"slug":"coinbase","entity_name":"Coinbase","trust_score":62,"severity_base":null,"score_modifier":18,"confidence":1,"status":"published","content_type":"investigation","summary":"Coinbase (NASDAQ: COIN) is the largest publicly listed cryptocurrency exchange in the United States, founded in 2012 and regulated across multiple jurisdictions. Despite its regulated status, the platform has been the subject of significant documented concerns: a May 2025 insider-enabled data breach affecting approximately 70,000 users with estimated remediation costs of $180–400 million, ongoing documented losses exceeding $300 million per year from social engineering scams targeting Coinbase users (as reported by blockchain investigator ZachXBT), a $100 million AML compliance settlement with the NYDFS in 2023, and controversies surrounding its Base Layer-2 blockchain including a disputed token launch and a contentious departure from the Optimism OP Stack ecosystem.","sections":[{"content":"On May 14, 2025, Coinbase disclosed via an SEC Form 8-K filing (Item 1.05 — Material Cybersecurity Incident) that threat actors had bribed multiple contractors and support employees located outside the United States to exfiltrate customer personal data from internal systems. The breach originated as early as September 2024, when at least one employee — later identified as Ashita Mishra, a TaskUs contractor in India — began photographing sensitive customer records and selling them for approximately $200 per image. On May 11, 2025, the attackers contacted Coinbase demanding a $20 million Bitcoin ransom in exchange for not publicly releasing the stolen data. Coinbase refused to pay and instead announced a $20 million bounty for information leading to the arrest and prosecution of those responsible. The breach affected approximately 69,461–70,000 customers. Compromised data included full names, addresses, phone numbers, email addresses, masked Social Security numbers (last four digits), masked bank account numbers, government-issued ID images, and account balance and transaction history data. Coinbase estimated remediation and customer reimbursement costs at between $180 million and $400 million. Multiple class action lawsuits were subsequently filed, including one in the Eastern District of Pennsylvania on behalf of investors who acquired COIN securities between April 14, 2021, and May 14, 2025, alleging material omissions in disclosures related to the breach. Coinbase's stock fell approximately 7.2% on the disclosure date.","heading":"2025 Insider-Enabled Data Breach","sources":[],"severity":"medium"},{"content":"Blockchain investigator ZachXBT has published extensive documented research on the scale of social engineering scams targeting Coinbase users. In a February 2025 thread (posted February 3, 2025 on X/Twitter), ZachXBT stated that Coinbase users were losing over $300 million per year to social engineering scams, and attributed part of the problem to the platform's aggressive risk models that resulted in widespread account restrictions without adequately preventing fraud. ZachXBT and researcher @tanuki42_ documented at least $65 million stolen from Coinbase users between December 2024 and January 2025 alone. In March 2025, ZachXBT reported an additional $46 million lost by Coinbase users in that month. A subsequent report noted $45 million lost in a single week. Scam tactics documented include: cloned Coinbase websites distributed via Telegram phishing panels, spoofed Coinbase support phone numbers with caller ID manipulation, fake email communications mimicking official Coinbase correspondence including fabricated support ticket IDs, and manipulation of victims into whitelisting attacker-controlled wallet addresses. ZachXBT identified two primary criminal organizations responsible: a group known as 'The Com' and a separate India-based operation, both primarily targeting US-based Coinbase customers. ZachXBT also documented a Canadian-based scammer referred to as 'Haby' or 'Havard' who stole approximately $2 million using fake Coinbase support impersonation. ZachXBT publicly criticized Coinbase's response as inadequate, recommending the exchange offer an option for advanced users to remove phone numbers from accounts, introduce a beginner-mode account type with withdrawal restrictions, publish security guides, deploy 24/7 incident response, flag theft addresses proactively, and block known phishing domains.","heading":"Social Engineering Scam Losses — ZachXBT Findings","sources":[],"severity":"medium"},{"content":"In January 2023, the New York State Department of Financial Services (NYDFS) announced a $100 million settlement with Coinbase following an investigation that found significant failings in the company's anti-money laundering (AML) compliance program. Under the settlement, Coinbase agreed to pay a $50 million civil penalty and invest an additional $50 million over two years into compliance program improvements. A DFS-appointed independent monitor was placed to oversee compliance for at least one additional year. The NYDFS investigation identified failures including inadequate know-your-customer (KYC) due diligence at onboarding, failure to timely review transaction monitoring alerts, and exposure of the platform to potential money laundering, fraud, and activity linked to child sexual abuse material. Separately, in March 2021, the CFTC ordered Coinbase to pay a $6.5 million civil monetary penalty for reckless false and misleading transaction reporting and wash trading. The violations occurred between January 2015 and September 2018. Two automated trading programs ('Hedger' and 'Replicator') were found to have traded against each other, and a Coinbase employee was found to have intentionally placed matching LTC/BTC trades over six weeks in 2016 to simulate liquidity. The SEC filed a civil enforcement action against Coinbase in June 2023 alleging that certain digital assets listed on the exchange constituted unregistered securities. The case was partially dismissed in March 2024. On February 27, 2025, the SEC announced it would dismiss the remaining claims against Coinbase, citing the formation of its Crypto Task Force dedicated to developing a comprehensive regulatory framework, and explicitly stating the dismissal did not reflect any assessment of the merits of the underlying claims.","heading":"Regulatory Actions — NYDFS and CFTC","sources":[],"severity":"medium"},{"content":"In April 2025, Coinbase's Layer-2 blockchain Base came under criticism following a token incident on the Zora content platform. On approximately April 16, 2025, Base posted a 'Base is for Everyone' message on Zora, which automatically generates an ERC-20 token under Zora's content coin standard. The token rapidly reached a peak market capitalization of approximately $17.1 million before collapsing roughly 90% within twenty minutes to approximately $1.9 million. On-chain analytics firm Lookonchain identified three wallets that purchased large positions prior to the broader announcement and subsequently sold for a combined profit of approximately $666,000, raising allegations of front-running or coordinated trading. Over 2,500 wallets were affected by the volatility. Coinbase issued a statement clarifying that Base would not sell its allocated tokens and that the coin was not an official Base, Coinbase, or product token. Critics noted that despite disclaimers, the official promotion on Base's X account was interpreted by many participants as an endorsement. The incident also prompted broader builder backlash, with developers building on Base alleging that the network's promotional resources and social support had become increasingly concentrated on Zora-linked projects, with established Base-native projects receiving little visibility.","heading":"Base Chain — Content Coin Controversy","sources":[],"severity":"medium"},{"content":"In February 2026, Coinbase announced that its Base Layer-2 network would migrate away from Optimism's OP Stack technology toward an independent unified solution. The announcement triggered an immediate decline of approximately 20–25% in the OP token price. The development raised questions about the future of Base's financial commitments to the Optimism Collective. Under the original agreement, Base could have earned up to approximately 118 million OP tokens over six years, and had been sharing 15% of Base's revenue with the Optimism Collective — a total of approximately 8,387 ETH (valued at roughly $16.4 million at announcement-day prices). Industry commentators noted that the departure significantly reduced revenue projections for the Optimism ecosystem and raised governance concerns about the degree to which large commercial entities can unilaterally reshape DAO-adjacent financial arrangements with limited notice.","heading":"Base Chain — Departure from Optimism OP Stack","sources":[],"severity":"medium"},{"content":"ZachXBT and other researchers have raised concerns about Coinbase's approach to user communication and protection that predate the May 2025 breach. ZachXBT noted in April 2025 that Coinbase had failed to disclose a breach that was already known internally, while simultaneously implementing aggressive account-restriction risk models that locked out legitimate users. The combination — restricted accounts alongside unreported data exposure — drew particular criticism as it left users unable to access funds while also being unaware their personal data had been compromised for months. The May 2025 breach disclosure confirmed that the attack had begun in September 2024, meaning Coinbase had approximately eight months of internal awareness before public disclosure. Coinbase has defended its approach, noting it cooperated with law enforcement and declined to pay the ransom. The company also announced the $20 million bounty program aimed at apprehending perpetrators.","heading":"Platform Transparency and User Protection Criticisms","sources":[],"severity":"medium"}],"timeline":[{"date":"2015","event":"CFTC later determined Coinbase's automated trading programs 'Hedger' and 'Replicator' began producing wash trades (violations covering January 2015 through September 2018).","source":"","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8369-21","date_original":"2015-01-01"},{"date":"2016-06","event":"A Coinbase employee placed intentional matching LTC/BTC trades over a six-week period to simulate liquidity, later found by CFTC to constitute wash trading.","source":"","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8369-21","date_original":"2016-06-01"},{"date":"2021-03-19","event":"CFTC ordered Coinbase to pay a $6.5 million civil penalty for false, misleading, and inaccurate reporting and wash trading.","source":"","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8369-21"},{"date":"2023-01-04","event":"NYDFS announced $100 million settlement with Coinbase over significant AML compliance failures, including inadequate KYC and transaction monitoring deficiencies.","source":"","source_url":"https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202301041"},{"date":"2023-06","event":"SEC filed civil enforcement action against Coinbase alleging the exchange listed unregistered securities.","source":"","source_url":"https://www.sec.gov/newsroom/press-releases/2025-47","date_original":"2023-06-01"},{"date":"2024-09","event":"Insider data theft at Coinbase began, with a TaskUs contractor in India photographing and selling customer records to outside threat actors for approximately $200 per image.","source":"","source_url":"https://beincrypto.com/coinbase-data-breach-insider-plot-court-documents/","date_original":"2024-09-01"},{"date":"2025","event":"TaskUs discovered the breach internally; at that point a single phone held data on more than 10,000 Coinbase customers.","source":"","source_url":"https://beincrypto.com/coinbase-data-breach-insider-plot-court-documents/","date_original":"2025-01-01"},{"date":"2025-02-03","event":"ZachXBT published findings on Coinbase social engineering scams, estimating $300M+ in annual user losses and documenting $65M stolen between December 2024 and January 2025.","source":"","source_url":"https://www.coindesk.com/markets/2025/02/04/coinbase-users-are-losing-usd300m-a-year-to-social-scams-zachxbt-says"},{"date":"2025-02-27","event":"SEC announced dismissal of its civil enforcement action against Coinbase, citing formation of its Crypto Task Force. The dismissal explicitly did not constitute any assessment of the merits of the original claims.","source":"","source_url":"https://www.sec.gov/newsroom/press-releases/2025-47"},{"date":"2025-04-07","event":"ZachXBT publicly criticized Coinbase over undisclosed data breach and account lockouts, stating users were being restricted without knowledge that their data had been compromised.","source":"","source_url":"https://news.shib.io/2025/04/07/zachxbt-slams-coinbase-over-account-lockout-and-data-breach/"},{"date":"2025-04-16","event":"Base's 'content coin' launched via Zora, reached $17.1M market cap, then collapsed approximately 90% within 20 minutes; pump-and-dump allegations followed, with three wallets identified as profiting approximately $666,000.","source":"","source_url":"https://fortune.com/crypto/2025/04/19/coinbase-zora-base-content-coin-jesse-pollak/"},{"date":"2025-05-11","event":"Threat actors contacted Coinbase demanding a $20 million Bitcoin ransom, claiming possession of customer data obtained via bribed support employees.","source":"","source_url":"https://investorclaims.com/blog/coinbase-data-breach-comes-with-20m-ransom/"},{"date":"2025-05-14","event":"Coinbase disclosed the data breach via SEC Form 8-K. Approximately 69,461–70,000 customers affected. Estimated remediation costs: $180M–$400M. Coinbase declined to pay ransom and announced a $20M bounty for information on perpetrators.","source":"","source_url":"https://www.sec.gov/Archives/edgar/data/0001679788/000167978825000094/coin-20250514.htm"},{"date":"2025-05-27","event":"Class action lawsuit filed against Coinbase in connection with the data breach, alleging securities disclosure omissions, covering investors from April 14, 2021 to May 14, 2025.","source":"","source_url":"https://www.theblock.co/post/355687/coinbase-sued-class-action-data-breach"},{"date":"2026-02-18","event":"Coinbase announced Base would migrate away from Optimism's OP Stack to an independent technology stack. OP token fell 20–25% on the announcement, and the Optimism Collective faced projected loss of significant future revenue.","source":"","source_url":"https://www.coindesk.com/business/2026/02/18/coinbase-s-base-moves-away-from-optimism-s-op-stack-in-major-tech-shift"}],"sources_used":[],"source_tags":["zachxbt","defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:21.768401+00:00","updated_at":"2026-08-29T01:33:28.071+00:00"}}