HN Reader

https://www.sec.gov/ix?doc=/Archives/edgar/data/0001679788/0...

I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves.

[1] https://www.youtube.com/watch?v=HNziOoXDBeg

And what that means is that

1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore.

2) Hackers can try to “recover” accounts now using this leaked info.

This is a huge problem. What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)

The only solution here is: hardware 2 factor like yubikeys.

If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom.

Reimbursing duped customers makes sense, as it seems like they would have a pretty straightforward case to make in court that Coinbase's actions led to their loss.

I'm more curious if someone who feels the need to move, change banks, change their email, hire a security detail etc. could successfully sue the company to recover some or all of those costs.

Based on the information present in the breach, I think it's likely that the source was their customer support in the Philippines. Monthly salary is usually < 1000$/month (entry-level probably even less than 500$) and a 5000$ bribe could be more than a year worth of money, tax-free. Considering the money you can make with that dataset now, this is just a small investment.

> •Name, address, phone, and email; •Masked Social Security (last 4 digits only); •Masked bank-account numbers and some bank account identifiers; •Government‑ID images (e.g., driver’s license, passport); •Account data (balance snapshots and transaction history); and •Limited corporate data (including documents, training material, and communications available to support agents).

This is every threat actor's dream. Even if you only had email addresses and account balances, this is a nightmare. Instead of blackmailing the company, you can now blackmail each individual user. "Send me 50% of your BTC and I won't publish all of your information on the internet". My guess is that we will have a similar situation like we had with the Vastaamo data breach...

https://en.wikipedia.org/wiki/Vastaamo_data_breach

> and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible

https://www.coinbase.com/blog/protecting-our-customers-stand...

> We will reimburse customers who were tricked into sending funds to the attacker due to social engineering attacks. If your data was accessed, you have already received an email from no-reply@info.coinbase.com; all notifications went out at 7:20 a.m. ET on 5/15 to affected customers.

Hopefully companies take this as a lesson about bottom dollar outsourcing your CS.

For those amounts, they could afford to have hired regionally local support agents, and paid them well over industry standard...

Historically, although KYC regulations were widespread in Communist countries, they were unthinkable in most democratic countries until 9/11, which provided spy agencies with their golden chance to write their wishlist into law. But unfortunately that helps foreign spy agencies just as much as, maybe more than, it helps domestic ones.

In https://en.wikipedia.org/wiki/Know_your_customer#Laws_by_cou... you can see when they were introduced in different countries.

I’m not usually a huge fan of crypto folks, but I applaud this.

I hope they are serious about paying the reward, and aren’t planning to rug-pull it.

[1] https://www.board-cybersecurity.com/alerts/

[2] https://www.board-cybersecurity.com/incidents/tracker/

It would be so simple to have access tracking and flag or lock out rogue employees... I look forward to seeing what the golden parachutes look like.

Why not just say what country the are from and how they hired them to start with. It's presented as those sneaky "overseas" people that somehow got access to our systems. This company makes what, a few billions in revenue but they couldn't vet and hire the right people?

Corruption in these countries is extremely common. We're used to having a government that actually works in western countries. In these cheaper countries, bribes are routine and almost unavoidable.

Given the culture of corruption and how little the support agents are paid, it was only a matter of time before some bad actor tried to bribe them. Medical bills are expensive and need to be paid, making the agents highly vulnerable to this type of attack.

For many, the choice would be to accept the bribe, or let their sick child suffer from a treatable condition.

Now that a high profile attack has happened, expect copycat attacks from other bad actors.

How many people are going to anonymously attack themselves now, just to get a reimbursement!

Correspondingly I'd assume either a) paying the ransom doesn't take it off the market or b) the info they stole isn't that interesting.

https://www.coinbase.com/en-de/blog/protecting-our-customers...

    What they got

    - Name, address, phone, and email

    - Masked Social Security (last 4 digits only)

    - Masked bank‑account numbers and some bank account identifiers 

    - Government‑ID images (e.g., driver’s license, passport)

    - Account data (balance snapshots and transaction history)

>On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection.

https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647...

The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked.

Not, "Gosh, 'overseas' people, what can ya do?"

It's hard to not believe in Karma sometimes.

Update to the Coinbase User Agreement

We are emailing you about an important upcoming update to the Coinbase User Agreement. This update will revise our Arbitration Agreement with you. We made these updates to streamline the process for resolving disputes.

You can read the entire agreement here. The revised terms are in sections 9.9, 9.10 and Appendix 6.

These terms apply only to disputes that you or we initiate after May 15, 2025. The current terms will continue to apply until May 15.

---

What date did this news come out? I see it just happens to be the same date as mentioned in this email, May 15. Coinbase sneakily is trying to prevent their customers from exercising their legal rights. If you work for Coinbase, you ought to be ashamed and quit. If you use Coinbase, remove all your assets immediately.

I'm open to hearing reasons why this is just a coincidence or I'm misinterpreting the situation. Please, go ahead.

From https://techcrunch.com/2025/05/15/coinbase-says-customers-pe...

> The company said the hacker stole customer names, postal and email addresses, phone numbers, and the last four-digits of users’ Social Security numbers. The hacker also took masked bank account numbers and some banking identifiers, as well as customers’ government-issued identity documents, such as driver’s licenses and passports. The stolen data also includes account balance data and transaction histories.

But I've always wondered why people think this is how investment vehicles work. I monkeyed around with stock market bets and even Robin Hood allows you to cash out of your positions.

Got to make it so employees can’t do anything nefarious. This helps protect them.