Coinbase Buried Data Breach Bombshell Ahead of IPO—Here’s What Leaked

Silicon Valley’s favorite crypto exchange played hide-the-hack with investors. Again.

How bad was it? We still don’t know—but the timing stinks worse than a rug pull. Right as Coinbase was polishing its S-1 for that sweet public market cash grab, security protocols apparently went out the window.

The real crime? Disclosure delays make FTX look transparent. At least when your house is burning, you yell ’fire.’

TLDR

• Coinbase knew about a customer data leak since January 2025, months before publicly disclosing it in May
• An India-based TaskUs employee was caught photographing work computer data with her personal phone
• The breach affected nearly 70,000 customers and could cost Coinbase up to $400 million
• Over 200 TaskUs employees were fired in a mass layoff following the incident
• Coinbase rejected a $20 million ransom demand from hackers who leaked the stolen data

Coinbase knew about a major customer data breach as early as January 2025, according to Reuters sources. The cryptocurrency exchange only disclosed the incident publicly in a May SEC filing.

The breach involved an employee of outsourcing firm TaskUs in India. Five former TaskUs employees told Reuters the worker was caught taking photos of her computer screen with her personal phone.

The employee and a suspected accomplice allegedly sold Coinbase customer information to hackers for bribes. Company investigators briefed other employees about the incident in the Indian city of Indore.

Coinbase was notified immediately when the breach was discovered. Three former employees and another person confirmed the company learned about it right away.

Data Breach Scale and Impact

The incident affected nearly 70,000 Coinbase customers. The exchange estimates the breach could cost up to $400 million in damages.

More than 200 TaskUs employees lost their jobs in a mass layoff that followed. The January layoffs drew attention from Indian media outlets at the time.

Only two specific employees were identified as the main culprits. TaskUs confirmed it fired two workers early this year for illegally accessing client information.

The outsourcing company said it immediately reported the activity to its client. TaskUs did not identify Coinbase by name in its public statement.

Ransom Demand and Public Disclosure

Hackers made a $20 million extortion demand to Coinbase in mid-May. The cryptocurrency exchange rejected the ransom payment request.

The hackers then leaked customer data online after their demands were refused. This prompted Coinbase to make its first public disclosure about the breach.

Company Responses

Coinbase said it cut ties with the TaskUs personnel involved in the incident. The company also ended relationships with other overseas agents and tightened security controls.

TaskUs described the breach as part of a broader criminal campaign. The company said the incident impacted multiple service providers working with the same client.

Police in Indore did not respond to requests for comment about potential arrests. Reuters could not confirm if any criminal charges have been filed.

Previous Security Issues

TaskUs faced similar allegations in 2022 involving crypto wallet maker Ledger. The company was sued over alleged failures to protect customer data from a previous breach.

That lawsuit claimed TaskUs and Shopify knew about a data breach for over a week. The companies were accused of delaying customer notifications about the incident.

Ledger customers continue to face scams and phishing attacks from the earlier breach. Hundreds of thousands of hardware wallet owners had their personal data exposed.