When a crypto exchange leaks your data: the 2025 Coinbase breach and how to spot fake support calls

Most people imagine a crypto hack as someone breaking into an account. The 2025 Coinbase breach was different: criminals bribed customer support staff to collect personal data, then used it to make scam calls far more convincing. No passwords were stolen. The danger was that customers would believe a caller who knew their name, address and balance.

This guide explains what Coinbase disclosed, why leaked data matters even without passwords, and the rules that protect you from fake support calls, wherever you hold your crypto. If you’ve already lost funds, see what to do if your crypto account is hacked.

What happened

Coinbase described the incident in a filing with the SEC on 15 May 2025:

• On 11 May 2025, it received an email from an unknown criminal claiming to have customer account information and internal documents, and demanding money not to publish them.
• The criminal appears to have obtained the data by paying contractors or employees in support roles outside the US to collect information from internal systems they could access for their jobs.
• Coinbase’s security monitoring had detected these cases of improper access in the previous months. It fired the staff involved and warned customers whose data may have been accessed.
• Coinbase concluded they were part of a single campaign that succeeded in taking data. It didn’t pay the demand and said it was cooperating with law enforcement.

What was taken, and what wasn’t

The filing says the incident didn’t compromise passwords or private keys, and the staff involved couldn’t access customer funds. But the stolen data included:

• names, addresses, phone numbers and email addresses;
• masked Social Security numbers (last four digits only);
• masked bank account numbers and some bank account identifiers;
• government ID images, such as driver’s licenses and passports;
• account data: balance snapshots and transaction history;
• limited internal documents, including training material available to support agents.

Why leaked data is dangerous

Coinbase said it was strengthening its anti-fraud protections because the stolen information could be used in social-engineering attempts, and its annual report for 2025 says the criminal did use it that way.

That’s the core risk. A caller who knows your name, your address, roughly how much crypto you hold and your recent transactions sounds like the real support team. Once you trust them, they don’t need your password: they need you to move the crypto.

The cost

In its May 2025 filing, Coinbase estimated costs of roughly $180 million to $400 million for fixing the problem and voluntarily reimbursing customers. It said it intended to reimburse eligible retail customers who had sent funds to the criminal as a direct result of the incident, and planned a new support hub in the US.

Its annual report for 2025 says it paid $311.2 million in cash related to the incident during the year, comprising voluntary customer reimbursements and direct legal costs. It also says it still faces risks from the incident, including government investigations, regulatory scrutiny and ongoing litigation.

How fake support scams work

The FTC warns that scammers impersonate well-known companies, often in waves. They text, call, email or message on social media, or show a pop-up alert. The script is usually that there’s fraud on your account or your money is at risk, and that to fix it you need to send crypto. The FTC also describes impersonators telling people to send crypto to a wallet address they provide, for “safe keeping”.

The rules that stop it

The FTC’s advice, applied to crypto accounts:

• No legitimate business will demand that you send crypto, not to buy something, and not to protect your money. The FTC says that’s always a scam.
• No legitimate business or government will email, text or message you on social media to ask for money.
• Never click a link in an unexpected text, email or message, even if it seems to come from a company you know.
• Don’t pay anyone who contacts you unexpectedly demanding crypto.

To those, add two crypto-specific rules:

• Never share your recovery phrase. No real support team needs it. See seed phrase security.
• Never read out a login or two-factor code to someone who called you. See SIM swaps and two-factor authentication.

If you get a call from “support”

1. Hang up, however convincing the caller is, and however much they know about you.
2. Contact the exchange yourself, through its official app or the website you normally use, not a number or link the caller gives you.
3. Don’t move funds anywhere because someone told you to.
4. Report it. See how to report crypto scams.

What it means when choosing an exchange

A data breach can happen at any company, and Coinbase’s case shows that the weak point can be people, not code. When choosing a platform, look at how it protects your account, how it contacts customers, and what it has said it will do if something goes wrong. See how to choose a crypto exchange and is your crypto insured?