I have recordings proving Coinbase knew about breach months before disclosure
jonathanclark.com
jonathanclark.com
> Cryptocurrency exchange Coinbase knew as far back as January about a customer data leak at an outsourcing company connected to a larger breach estimated to cost up to $400 million, six people familiar with the matter told Reuters.
https://www.reuters.com/sustainability/boards-policy-regulat...
> On May 11, 2025, Coinbase, Inc., a subsidiary of Coinbase Global, Inc. (“Coinbase” or the “Company”), received an email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation, including materials relating to customer-service and account-management systems.
https://www.sec.gov/Archives/edgar/data/1679788/000167978825...
From what I've seen, this is going to be a common subheading to a lot of these stories.
They also asked if I had cold storage. I told them I had a fridge (also true).
The author got a phishing call and reported it. Coinbase likely has a deluge of phishing complaints, as criminals know their customers are vulnerable and target their customers regularly. The caller knowing account details is likely not unique in those complaints; customers accidentally leak those all the time. Some of the details the attacker knew could have been sourced from other data breaches. At the time of complaint, the company probably interpreted the report as yet another customer handling their own data poorly.
Phishing is so pervasive that I wouldn't be surprised if the author was hit by a different attack.
There's tons of options. Malware, evil maid, shoulder surfing, email compromise, improper disposal of printouts, prior phishing attack, accidental disclosure.
With the analysis you provided of the email, your report definitely deserved to be taken seriously, but Coinbase could easily get dozens of emails reporting "compromise" of the personal details you provided that were obtained by good ol' fashioned OSINT and poor personal privacy practices.
Their fix was to put a piece of paper over the passwords.
What a time.
Sending unsolicited bills for unrequested services is a great way to make sure nobody takes your email seriously
Billing for random things outside of the agreed upon scope of work is actually unreasonable. It’s something covered in every contracting agreement I’ve ever been a part of.
Maybe they could point to some contract that maybe would have covered it, but when your contractors start billing you for sending quick emails about unrelated things you didn’t ask them to look into, it’s not a good sign. When contractors bill for quick emails they don’t bill for the 3.7 minutes it took to write, they round up to some bigger number like an hour.
Anecdotally, every time I’ve encountered contractors who started billing per individual communication that they initiated (not something requested) or started finding new things to bill us for that we didn’t ask, it was a sign that we were a target being milked for billable hours. Some contractors have a lightbulb moment when they think nobody is scrutinizing their billing and think they discovered an almost infinite money glitch by initiating new things that they can bill for. None of the good contractors I’ve worked with over the years would even think to bill for an individual short email.
"Let's defend Coinbase, that small little startup!"
Maybe just stop being a boot licker? It seems pathetic from the outside.
A lot of it is about setting boundaries with the client. If I have a conversation with you a handful of times to remove password from a whiteboard and you don't do it, that's a big deal and would professionally impact me if something bad happened. Cause like, your client's clients includes Coinbase. Like another person commented -- I really should have just dropped them as a client because the professional risk was too high.
That’s not what I’m talking about.
Responding to a company is responding to a request they made for your time.
That said, most contractors I’ve worked with would not bill for a short email saying they’re unable or unwilling to do some work as a professional courtesy. The contractors who literally bill and round up for every email are usually going out of their way to maximize billing, which is eventually accounted for in the rates we’re willing to pay for them. We learn quickly that certain contractors will bill and round up for everything, so the most we’re willing to entertain as an hourly rate for them is lower as we know they’re going to send arbitrarily higher amounts of hours over.
I've been oncall for long enough in my career to know that a "quick email" is not, really, a "quick" email. It can completely derail everything you do for the day. If on-request work takes five minutes to write an email, then that time includes reading the email, thinking about the email, responding to the email, the cost of derailment of other contract work, the cost of getting back into that other contract work, the research needed to tell them "no". Again, it's about setting boundaries with the client.
Bitcoin, and really fintech as a whole, are beyond reckless.
It's breathtaking how frequent these are.
No such mechanisms in Bitcoin, so hacks have longer-term impact.
With Bitcoin you do not get government bailouts like what happened with the beyond reckless banks in 2008.
It is not beyond imagination that the most popular Bitcoin blockchain (and thus, the label of being the "real" Bitcoin) could change at some point in the future.
"Bitcoin" is not immune from the implications of political fuckery.
I don't know what the specific mechanism would be, but I would bet that it relates to the billions of dollars backing the current ecosystem, and the interests of the people behind them. If the right event or crisis comes along, then people could be compelled to switch over to something else.
I'm sure there's someone out there still mining blocks on that chain with the exploit from 2010, but that's not where the mining power is. If the right series of events occurs, the miners will switch.
But if, say, a mere 99% of miners switch, it’s far from a given that people would follow. Having more mining capacity makes the chain more secure, but it’s not that big of a deal.
If miners suddenly fled en masse, it’s possible for the chain to be left stranded where the small number of miners remaining couldn’t realistically get to the next 2016-block interval to adjust the difficulty down to match the drastically decreased mining capacity. If mining capacity dropped by a factor of 1000 and it happened right after an adjustment, then bitcoin would be producing about one block every week, and it would take about 40 years (if mining capacity stayed constant) to reach the next adjustment.
The miners do not control the network. The people transacting on the network control the network and decides who is rich and who is not; and whether the miners get paid or not.
Governments around the world are 100% attempting different plans to destabilize or destroy Bitcoin because it harms their interests and ability to print money from thin air. But at the end of the day it's a distributed ledger, so even if they do find a way to manipulate or damage or takeover the network the Bitcoin users can just fork it from before they did their damage and continue from there. That is the ultimate power of a decentralized blockchain, nobody has ultimate power and everyone votes with their resources.
The government in the US has far bigger guns than the citizenry these days.
The only thing that will ever prevent a government from abusing its populace is the willingness of actors of the state - police and soldiers - to say no to abusive orders. Independent thinking coupled with believing in the people more than the executive is the only thing that will ever keep us safe. Guns are not defensive tools. The state can shoot you before you shoot them if they decide they don't like what you're doing.
Put guns in the hands of the people you're policing and you just make it that much easier for the police/soldiers/govt sympathizers to make it us-against-them and side with the totalitarians.
I guess arresting ten thousand people a year for grevious hurting of the feefees with assault tweets is a recently prevented overstep that the citizens of some other countries have not been able to prevent.
It's that everything you do on the blockchain is there forever, so if a government needs you in jail for using it, they can show you were involved in a financial crime and the blockchain proves it... And if you are unwilling to give up your public wallet they can keep you in jail indefinitely until you do.
Bitcoin is pseudonymous, not anonymous. Every activity on the network is encoded into a perpetual auditable dataset, by design.
We're right on the corner of that very day that you're talking about.
Bitcoin is not an immutable law of nature. If the coin minting cap is reached, all that needs to happen is for miners to start running a fork with a higher cap. Tada, more coins conjured out of the ether, just like all the previous ones. If you want enforced scarcity, you need to be tied to something physically scarce.
The node operators play just as critical of a role in Bitcoin as the miners.
In fact they already have. There are 10s of thousands of forks of Bitcoin. Only a handful ever got significant attention. And, the original is still much larger than all of the forks combined.
all that needs to happen is for governments to stop burning fossil fuels
all that needs to happen is for researchers to publish boring papers replicating others results
all that needs to happen is for fishermen to stop overfishing
Coordination problems seem easy but never really are. The chance of all the miners just suddenly agreeing to do something all at once is pretty low to impossible.
The point of a hypothetical suggestion is to direct a specific course of action. I am simultaneously amazed at how complex the 'hypothetical' construct is, and also how many people aren't able to reason around them... since this is basically what our big brains are for.
If you assume everybody involved just stops responding to their current incentives, you can solve any coordination problem, in a manner of speaking. But it's useless as a battle plan. Operationalizing a change demands that you pick a party you're talking to, and with full view of their capabilities and limitations, modify their current course of action in the smallest possible way that accomplishes a change.
First thing that comes to mind off the top of my head as a US-Govt option here would be something like: bail out US people/companies of bitcoin holdings in USD in conjunction with banning bitcoin in the US going forward. So that would be quite the string of events at that point for non-US bitcoin holders: first a crash that caused all these US bitcoin holders to go screaming to the government for help. Then the overnight removal of a huge chunk of the bitcoin market, coupled with either a firesale to comply with the ban or US gov seizure of a bunch of the coins, which will push the price lower for anyone who hasn't sold yet since their buyer pool is now much lower.
Is that really possible? Can we do this today?
Everybody who ever created a meme coin should also be put on the same plane, voluntary or not.
The government of Ethereum is not the US government.
By that logic every company is a government?
The other is an organization body that you freely choose to associate with, eg: using Etherium.
I don't understand how you can conflate the two.
Vitalik did not print billions of dollars out of thin air and then force every citizen of the US to bear that cost through the inflation of the US dollar eating away at their savings and investments.
I have seen some toe curling shit in fintech.
It was a fun time. They eventually fixed it in the app to show my true balance and fixed my statements back to what it was. But holy shit, the fact that an engineer would think that would be the proper fix is wild... this is pre-llms, otherwise, I'd think they'd been vibe-coding.
One place that they basically force you to use it, is my local drug store (big chain, that I won't call out by name).
Their auto-cashier absolutely sucks. It's almost impossible to avoid having an issue that requires you waiting around for the poor schulb to come over and fix.
They recently set up touchscreens, at the prescription counter.
I have not once had success with the touchscreen. It can never find me, or my wife. They always have to just take my information manually.
I suspect that the backend (the algorithm and main engine) is good. I think almost all the problems are with shoddy frontend stuff. For example, I think the touchscreen issue is capitalization, and the old system cut off our surnames, so I actually have to type in about half my name, in all caps, to have it find my prescription.
I feel personally offended, when I encounter stuff like that.
Oh, and here real cashiers usually scam you by scanning the items twice and so forth (not sure if intentionally or not), it happened a couple of times to my parents (not considered elderly yet) in the past few months I would say.
In any case, I feel your pain.
I use the one with the better self service checkout, that doesnt reliably make me wait for the schlub.
If you give me $5, and then I pass it on to Bob for you, how many licenses and how much paper work do you think I should need to do that if I did that as a business? If you give me some money and I am a business, how much paperwork should that incur?
From what I was told, the issue for the exchange was that if they were found out to not enforce their self regulation then it'd be the precipitous event to the hammer coming down on them from regulatory bodies.
So yeah. Regulation's kinda shite here.
Not one (I last checked about a month ago!)
Security, while pretty good, is still lacking imo!
However, I use a Yubikey as often as I can nowadays and authenticator apps too where possible.
I'd like the option to use one but I can't :(
Not saying it is untrue, but it is definitely true that Coinbase has never lost customer funds while operating in an environment with 0 safety nets and being one of the most lucrative targets.
This leak over customer data suggests that they should treat that with as much obsession as they do with their private keys.
[1] https://www.kalzumeus.com/2019/10/28/tether-and-bitfinex
As I said, they have never lost customer funds in their custody.
How do you know?
Somehow I think Nathaniel Popper would have been able to put that fact directly in his NYT article instead of a throw away tweet if there was a material impact. Heck he wasted a paragraph quoting one of Coinbase's board of directors on the risks of unregulated exchanges like bitfinex versus Coinbase.
The fact that lax security has never caused them to loose billions of dollars of customer funds is just luck and paper covering passwords on a whiteboard.
Even leaving your laptop unlocked for seconds in the office would have someone /pwn it in slack and get flagged by security.
If there’s one thing they took extremely seriously it was data security.
The "recordings" are of a phisher attempting to get information from the author. It proves nothing about what Coinbase knew.
The author turned the information over to Coinbase, but that doesn't prove Coinbase knew about their breach. The customer could have leaked their account details in some other way.
Edit: Nevermind; I see you addressed that here:
I stand by my statement that the title is clickbait, as it's misleading on two fronts:
- It's the email, not the call recording that proves what Coinbase knew, but "recordings prove" sounds more sensational
- The email proves that Coinbase was aware of a sophisticated attack against a single user. You didn't have enough information to prove that there was a large scale leak of Coinbase customer data. There are sophisticated attacks against individual Coinbase users all the time due to the value of the accounts there.
I'm not trying to be recalcitrant, rather I am genuinly curious. The reason I ask is that no one talks like a LLM, but LLMs do talk like someone. LLMs learned to mimic human speech patterns, and some unlucky soul(s) out there have had their voice stolen. Earlier versions of LLMs of LLMs that more closely followed the pattern and structure of a wikipedia entry were mimicking a style that that was based of someone elses style and given some wiki users had prolific levels of contributions, much of their naturally generated text would register as highly likely to be "AI" via those bullshit ai detector tools.
So, given what we know of LLMs (transformers at least) at this stage it seems more likely to me that current speech patterns again are mimicry of someones style rather than an organically grown/developed thing that is personal to the LLM.
Not saying the article is bad, it seems pretty good. Just that there are indications
Might as well say "You can tell by the way it is".
2. AI detecting a scam, sure - it’s a scam. AI saying the email is ok… then what? I’d never trust it.
You're staking personal reputation in the output of something you can expect to be wrong. When someone gets a suspicious email, they follow your advice, and ChatGPT incorrectly assures them that it's fine, then the scammed person would be correct in thinking you're a person with bad advice.
And if you don't believe my arguments, maybe just ask ChatGPT to generate a persuasive argument against using ChatGPT to identify scam emails.
EDIT: having said that, many of the other articles on the blog do look like what would come from AI assistance. Stuff like pervasive emojis, overuse of bulleted lists, excessive use of very small sections with headers, art that certainly appears similar in style to AI generated assets that I've seen, etc. If anything, if AI was used in this article, it's way less intrusive than in the other articles on the blog.
There are some still some signs you can tell content is AI written based on verbosity, use of bold, specific HTML styling, etc. I see no issues with the approach. I noticed some people have an allergic reaction to any hint of AI, and when the content produced is "fluff" with no real content I get annoyed too - however that isn't the case for all content.
Please, at least put a disclaimer on top so I can ask an AI to summarize the article and complete the cycle of entropy.
Generating thousands of words because it's easy is exactly the problem with AI generated content. The people generating AI content think about quantity not quality. If you have to type out the words yourself, if you have to invest the time and energy into writing the post, then you're showing respect for your readers by making the same investment you're asking them to make... and you are creating a natural constraint on the verbosity because you are spending your valuable time.
Just because you can generate 20 hours of output in 30 minutes, doesn't mean you should. I don't really care about whether or not you use AI on principle, if you can generate great content with AI, go for it, but your post is classic AI slop, it's a verbose nightmare, it's words for the sake of words, it's from the quantity over quality school of slop.
> I had a blog 20 years ago but since then I never had time to write content again (too time consuming and no ROI) - so the alternative would be nothing.
Posting nothing is better than posting slop, but you're presenting a false dichotomy. You could have spent the 30 minutes writing the post yourself and posted 30 minutes of output. Or, if you absolutely must use ChatGPT to generate blog posts, ask it to produce something that is a few hundred words at most. Remember the famous quote...
"If I had more time, I would have written a shorter letter."
If ChatGPT can do hundreds of hours of work for you then it should be able to produce the shortest possible blog post, it should be able to produce 100 words that say what you could in 3,000. Not the other way around!
Well if that's how we identify humans I for one prefer our new LLM overlords.
A lot of people who say stuff like "boo AI!" are not only setting the bar for humanity very low, they're also discouraging intellectualism and intelligent discourse online. Honestly, if a LLM wrote a good think piece, I prefer that over "human slop".
I just wish people would critique a text on its own merits instead of inventing strawman arguments about how it was written.
Oh and, for the provocative effect — I'll end my comment with an em dash.
Way too verbose to get the point across, excessive usage of un/ordered bullets, em dashes, "what i reported / what coinbase got wrong", it all reeks of slop.
Once you notice these micro-patterns, you can't unsee them.
Would you like me to create a cheat sheet for you with these tell tale signs so you have it for future reference?
> Over‑polished prose – flawless grammar, overly formal tone, and excessive wordiness.
> Repetitive buzzwords – phrases like “delve into,” “navigate,” “vibrant,” “comprehensive,” etc.
> Lack of perspective shifts – AI usually sticks to a single narrative voice; humans naturally mix first, second, and third person.
> Excessive em‑dashes – AI tends to over‑use them, breaking flow.
> Anodyne, neutral stance – AI avoids strong opinions, trying to please every reader.
> Human writing often contains minor errors, idiosyncratic punctuation, and a more nuanced, opinionated voice.
> It's not just x, it's y
Overuse of "Here's..." to introduce or further every concept or idea.
A few parts of this article particularly jump out, such as the 2 lists following the "The SMS Flooding Attack" section (which incidentally begins "Here's where..."). A human wouldn't write them as lists (the first list in particular), they'd be normal paragraphs. Short bulleted lists are a good way to get across simple bite-sized pieces of information quickly, but that's in cases where people aren't going to read a large block of text, e.g. in ads. Overusing them in the wrong medium, breaking up a piece of prose like this, just hurts its flow and readability.
And so at this point the excessive bullet points and similar filler trash is also just an expression of whatever stupid people think they prefer.
Maybe I'm being too harsh and it's not the raters are stupid in this constellation, rather it's the ones thinking you could improve the LLM by asking them to make a few very thin judgements.
The sentence-level stuff was somewhat improved compared to whatever “jaunty Linked-In Voice” prompt people have been using. You know, the one that calls for clipped repetitive phrases, needless rhetorical questions, dimestore mystery framing, faux-casual tone, and some out-of-proportion “moral of the story.” All of that’s better here.
But there’s a good ways left to go still. The endless bullet lists, the “red flags,” the weirdly toothless faux drama (“The Call That Changed Everything”, “Data Catastrophe: The 2025 Cyber Fallout”), and the Frankensteined purposes (“You can still protect yourself from falling victim to the scams that follow,” “The Timeline That Doesn't Make Sense,” etc.)…
The biggest thing that stands out to me here (besides the essay being five different-but-duplicative prompt/response sessions bolted together) are the assertions/conclusions that would mean something if real people drew them, but that don’t follow from the specifics. Consider:
“The Timeline That Doesn't Make Sense
Here's where the story gets interesting—and troubling:
[they made a report, heard back that it was being investigated, didn’t get individual responses to their follow-ups in the immediate days after, the result of the larger investigation was announced 4 months later]”
Disappointing, sure. And definitely frustrating. But like… “doesn’t make sense?” How not so? Is it really surprising or unreasonable that it takes a large organization time, for a major investigation into a foreign contractor, with law enforcement and regulatory implications, as well as 9-figure customer-facing damages? Doesn’t it make sense (even if it’s disappointing), when stuff that serious and complex happens, that they wait until they’re sure before they say something to an individual customer?
I’m not saying it’s good customer service (they could at least drop a reply with “the investigation is ongoing and we can’t comment til it’s done”). There’s lots of words we could use to capture the suckage besides “doesn’t make sense.” My issue is more that the AI presents it as “interesting—and troubling; doesn’t make sense” when those things don’t really follow directly from the bullet list of facts afterward.
Each big categorical that the AI introduced this way just… doesn’t quite match what it purports to describe. I’m not sure exactly how to pin it down, but it’s as if it’s making its judgments entirely without considering the broader context… which I guess is exactly what it’s doing.
Screenscraping malware is fairly common, and it’s not unreasonable for an analyst to look at a report like this and assume that the customer got popped instead of them.
Customers get popped all the time, and have a tendency to blame the proximate corporation…
I don't know why you think acknowledgement of your report is concrete evidence that coinbase knew about their breach months before it was disclosed.
They paid a pittance and permanently buried the report even though its release wouldn't have posed a risk anymore.
Did the support agents have the ability to send arbitrary emails from commerce@coinbase.com? If not, how did the scammers send a properly signed email?
What does this mean?
> While both amazonses.com and coinbase.com DKIM checks passed, this is exactly how phishing works—attackers can configure Amazon SES to send "from" coinbase.com
How does Amazon SES let you sign an email from a domain you don't control? Unless this means that somehow the scammer had access to DNS records for coinbase.com which indicates some really crazy compromise somewhere either of Coinbase or the DNS chain.
I'm very confused.
Coinbase is good for on-ramping, bad for storage. You know, the entire point of cryptocurrency.
Even if they find the inside individuals, how could anyone ever present a legal case?
They send github repo and as soon as you run it they send rejection after stealing tokens and installing keylogger. Pretty sophisticated and the frontend of the codebase looked polished as well.
The whole industry (except deribit) is a shit show of barely working apis that aren’t reliable or accurate in any way. It’s completely routine to not be able to get an order status for minutes at a time. Or to get fills after an order has been rejected. Or a week after a cancel confirmation message.
Coinbase is actually one of the worst offenders for this. Coinbase Prime, their supposed institutional grade offering especially so.
So it doesn’t surprise me at all that the same issues are happening more widely.
To be clear: deribit have always been efficient, accurate, reliable and generally excellent. If you must trade crypto, do it there so you’re Ops and Support people don’t have to suffer.
- excessive em-dashes
- useless words, verbosity
Then I reached out to customer service several times - no answer. Then I contacted dedicated channel for privacy related questions with all proofs of mishandling - radio silence.
It’s sad to see these companies mishandle our very personal data and get away with this.
If so and if the US had a sane administration maybe, this would be acted upon, but these days, anything goes as long as you 'donate' to the ballroom.
Looking into this more now I see SEC Rule requiring disclosure within 4 business days of determining a cybersecurity incident is "material"
There is a big list of SEC violations as a result: 1. Late Disclosure (Item 1.05) If materiality was determinable in January → 4-day rule violated Penalty: Fines, enforcement actions
2. Misleading Statements/Omissions (Rule 10b-5) Any public statements about security between Jan-May could be problematic Omitting known material risks = securities fraud
3. Inadequate Internal Controls (SOX) Failure to properly investigate and escalate user reports Inadequate breach detection systems
4. Failure to Maintain Adequate Disclosure Controls My report should have triggered disclosure review Going silent suggests broken escalation process
Matt Levine has a prescient and depressing quote about the only recourse for being being shareholder lawsuits:
> I find all of this so weird because of how it elevates finance. [Various cases] imply that we are not entitled to be protected from pollution as citizens, or as humans. [Another] implies that we are not entitled to be told the truth as citizens. (Which: is true!) Rather, in each case, we are only entitled to be protected from lies as shareholders. The great harm of pollution, or of political dishonesty, is that it might lower the share prices of the companies we own.
* To be clear, I don’t think it is nebulous, and you’re right to feel harmed. But, legally, I don’t know the harm in “they didn’t respond to my emails” after there’s no concrete damage.
I've never looked at the Coinbase agreement that's presented when you open an account, but chances are you would have to go through arbitration first. That's not necessarily a bad thing.
Maybe I am in minority here but just wanted to provide this feedback: The background animation of the blog page is really distracting and making it difficult to focus on the actual content.
Please omit internet tropes and avoid posting shallow dismissals on HN. Substantive critique is always fine.