Coinbase Faces $400 Million Risk from Delayed Data Breach Disclosure

Coinbase was aware of a customer data leak involving outsourcing firm TaskUs as early as January 2025 but delayed public disclosure until months later. The breach, which occurred at TaskUs’ Indore office, involved an employee photographing sensitive customer data using a personal device. The stolen information included names, phone numbers, addresses, ID documents, account balances, and transaction histories. This incident could potentially cost Coinbase up to $400 million in damages and reputational harm. The delayed disclosure raises concerns about transparency and customer protection in the cryptocurrency industry, particularly for major exchanges like Coinbase that handle vast amounts of sensitive financial data. As of June 2025, the full ramifications of this breach are still unfolding, with potential regulatory and legal consequences for both Coinbase and TaskUs.

Coinbase Knew Customer Data Was at Risk in Vendor Hack Months Before Disclosure

Coinbase was aware of a customer data leak at outsourcing firm TaskUs as early as January, months before publicly disclosing the breach. The incident, which could cost the exchange up to $400 million, involved an employee at TaskUs’ Indore office photographing sensitive data with a personal device.

Stolen information included names, phone numbers, addresses, ID documents, account balances, and transaction history for nearly 70,000 users. TaskUs fired over 200 employees following the breach, though the company only confirmed two dismissals related to unauthorized data access.

The delayed disclosure raises questions about transparency in cryptocurrency exchanges’ handling of security incidents. Market participants will be watching for regulatory repercussions as the SEC filing brings the matter into public view.