Coinbase Exchange Standard

Documented events with consequences still open. Each entry carries a source and a date.

1. May 14, 2025 Data breach Critical $345M ● open

   Data theft via bribed overseas support agents, with the ransom refused

   Coinbase refused the $20 million ransom and disclosed the incident to the SEC in a Form 8-K. No passwords or private keys were compromised and no customer funds were accessible. Stolen data: name, address, phone, email, last four digits of the tax ID, masked account numbers, government-ID images, balances and transaction history. The FY2025 accounts book $345.2 million of net losses and $311.2 million of cash actually paid out, between voluntary customer reimbursements and legal costs: the reimbursement is therefore confirmed by an SEC filing, not by a press release. A further $8.6 million in Q1 2026: the tab is still open. The figure of about 70,000 affected customers comes from the Maine Attorney General notification and does not appear in the 8-K.

   ↗ source
2. Aug 7, 2025 Class action Severe ● open

   Federal data-breach class actions consolidated into a single proceeding in New York

   The Judicial Panel on Multidistrict Litigation centralised eleven actions pending in four districts, plus eight potential tag-along actions, in the Southern District of New York. Plaintiffs challenge the adequacy of Coinbase's data security and the timing of breach notification. Coinbase is seeking to push the claims into individual arbitration under its user agreement. Still open: it was not verified whether a ruling on the arbitration motion has been issued.

   ↗ source
3. Jan 4, 2023 Fine Severe $50M ✓ resolved

   New York: $50 million penalty for anti-money-laundering failures

   The New York State Department of Financial Services found the customer due diligence programme “immature and inadequate”, transaction monitoring ineffective, and identified more than 100,000 unreviewed alerts by late 2021. Coinbase accepted a $50 million civil penalty, neither tax-deductible nor insurable, and committed to invest at least a further $50 million in its compliance programme within 24 months, under an independent monitor.

   ↗ source
4. Feb 3, 2026 Data breach Moderate ✓ resolved

   Second insider case: a contractor accessed data of about 30 customers

   A separate incident, unrelated to the 2025 data theft. The improper access dates to December 2025 and was detected by the security team; the contractor no longer works for the company. Data exposed per the support-interface screenshots leaked on Telegram: email, name, date of birth, phone, identity verification information, balances and transaction records. Affected customers were notified and given identity-theft protection.

   ↗ source
5. Jul 25, 2024 Fine Moderate ✓ resolved

   UK: £3.5 million FCA fine for onboarding high-risk customers in breach of a restriction

   The Financial Conduct Authority's first ever penalty under the Electronic Money Regulations 2011. CB Payments Ltd repeatedly breached a voluntary requirement agreed with the regulator, onboarding 13,416 customers classified as high-risk, with around $25 million in prohibited deposits that fed roughly $226 million of transactions.

   ↗ source

verified on Jul 20, 2026

Weighted average across 3 public review platforms (2,745,374 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.