Coinbase May 2025 Customer Data Incident: Official Response and Account-Loss Steps
On May 15, 2025, Coinbase published information about a customer-data incident and an extortion attempt. This article summarizes Coinbase’s own public materials and provides general preservation and account-security steps. It does not make findings about liability in any individual matter.
WHAT COINBASE REPORTED
According to Coinbase, criminals paid a small group of overseas support personnel to copy data available through customer-support tools. Coinbase stated that the information related to less than one percent of its monthly transacting users.
Coinbase reported that the accessed information could include names, addresses, phone numbers, email addresses, masked Social Security numbers, masked bank-account information, government-identification images, balance snapshots, and transaction history. Coinbase also stated that passwords, two-factor-authentication codes, private keys, customer funds, Coinbase Prime accounts, and Coinbase wallets were not accessed through this incident.
Coinbase said the information was sought for social-engineering attacks in which criminals impersonated Coinbase personnel and attempted to persuade customers to transfer cryptocurrency. Coinbase also reported receiving a $20 million ransom demand, which it said it declined to pay.
Official Coinbase incident page: https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists
Official Coinbase account-loss reporting page: https://help.coinbase.com/en/privacy-and-security/other/report-an-account-loss
COINBASE’S PUBLISHED RESPONSE
Coinbase stated that it notified customers whose information it knew had been accessed, strengthened safeguards, increased monitoring, and worked with law enforcement. Coinbase also published criteria for voluntary reimbursement of certain retail customers who, before May 15, 2025, sent funds to the attackers as a direct result of the incident. Eligibility and current procedures are determined by Coinbase; affected users should consult Coinbase’s current official materials rather than rely on summaries.
IMPORTANT DISTINCTIONS
A notice that customer data was accessed does not necessarily mean that an account was taken over or that funds were transferred. Conversely, a customer may experience an impersonation attempt or unauthorized activity that is unrelated to this specific incident.
Whether a particular loss falls within Coinbase’s published reimbursement process depends on the evidence, timing, notices received, and Coinbase’s review. The public incident materials do not, by themselves, establish legal liability or the outcome of an individual claim.
STEPS FOR A POTENTIALLY AFFECTED CUSTOMER
Preserve the notice Coinbase sent, including full email headers. Keep screenshots, text messages, call logs, wallet addresses, transaction hashes, support tickets, and account statements. Write down the sequence of events while details are fresh.
Secure the email account and phone number linked to the account. Change reused passwords, review active sessions and security settings, and contact the mobile carrier if a SIM swap or unauthorized number change may have occurred. Use Coinbase’s official website or app to reach support; do not rely on phone numbers or links supplied by an unsolicited caller or message.
If assets were transferred, document whether the transfer was initiated by an intruder or initiated by the customer after deception. That distinction can affect technical tracing, platform review, and legal analysis.
LEGAL REVIEW OF A COINBASE-RELATED LOSS
Coin Counsel evaluates matters involving alleged Coinbase account takeovers, impersonation scams, SIM swaps, unauthorized transfers, restricted accounts, and inaccessible funds. Review is fact-specific and may include account notices, authentication records, transaction history, communications, device evidence, and the terms applicable at the relevant time.
Learn more about cryptocurrency stolen from a Coinbase account: https://www.coin-counsel.com/crypto-stolen-from-coinbase-account
Learn more about a restricted or inaccessible Coinbase account: https://www.coin-counsel.com/coinbase-account-restricted-lawyer
INDEPENDENCE AND LEGAL NOTICE
Coin Counsel is a division of Franco Law PLLC and is independent from Coinbase. It is not affiliated with, sponsored by, or endorsed by Coinbase. Coinbase is a trademark of its respective owner and is used only to identify the platform discussed.
This material is attorney advertising and is for general informational purposes only. It is not legal advice and does not create an attorney-client relationship. No recovery, reimbursement, or other outcome is guaranteed. Prior results do not guarantee a similar outcome.
