KYC Honeypot: Coinbase Admits Bribed Insiders Copied Customer IDs And Addresses

Remember the ID check you passed to open your exchange account? At Coinbase, those ID images sat in the customer support tools. And criminals paid insiders to copy them.

Coinbase disclosed the breach on Thursday, 15 May 2025, in an SEC filing and a blog post.

They admit it. In Coinbase’s own words: “Criminals targeted our customer support agents overseas. They used cash offers to convince a small group of insiders to copy data in our customer support tools for less than 1% of Coinbase monthly transacting users.”

Cash offers. Insiders. YOUR data.

Here is what walked out the door, according to The Record: “names, addresses, phone numbers and email addresses; ‘masked’ versions of the last four digits of customer Social Security numbers and similarly encoded bank-account numbers; images of government IDs such as driver’s licenses; account data such as transaction histories; and ‘limited corporate data.’”

Your name. Your address. Your government ID. Your transaction history. One file.

“Masked,” they say. The last four digits of your Social Security number, “masked.” Your bank-account number, “similarly encoded.” Feel safer yet?

Then came the shakedown. On 11 May 2025, an “unknown threat actor” emailed Coinbase a demand for $20 million, “threatening to publish stolen data about Coinbase customers,” The Record reported.

Coinbase refused to pay. “Instead of paying the $20 million ransom, we’re establishing a $20 million reward fund,” the company said.

A $20 million reward fund sounds tough. It can’t pull your face back off a leaked driver’s license. It can’t change your address.

The bill? Coinbase estimates it will spend $180 million to $400 million on remediation and response costs.

They Didn’t Need To Hack Anything

This was no break-in through the firewall. Help Net Security reported that “the attack did not involve the compromise of company systems or networks.”

They didn’t need to hack the vault. They paid the people who could open the files.

According to The Record, the stolen data did not include “login credentials or two-factor authentication codes, private keys, ‘the ability to move or access customer funds,’ access to Coinbase Prime accounts or access to cryptocurrency wallets.”

No funds were stolen in the breach itself. The PEOPLE were exposed. And Coinbase said it would reimburse retail customers who were tricked into sending funds to the scammers.

Coinbase put the damage at under 1% of monthly transacting users. The Record estimated that means fewer than 100,000 people out of about 9.7 million monthly users.

Under 1% sounds small. Not if your name is in the file.

This is not a Monero story. It is a story about the file.

The Honeypot

As we have warned, every pile of ID scans is a target. The bigger the pile, the bigger the target.

How many support agents could pull up your driver’s license? Who was watching them? And what did it take to turn them? A cash offer.

And the technocrats want more of these files, not fewer. From 10 July 2027, EU law will bar crypto providers from keeping anonymous accounts.

More ID checks. More files. More honeypots.

Keep Less Of Yourself In Their Files

You can’t take back an ID you already uploaded. You can decide what else you leave on someone else’s servers.

Coins in a self-custody wallet sit behind keys on your own device, not in a support tool. Monero One is a self-custody Monero wallet. Full disclosure: the host built Monero One. He’s biased. He’s also right.

Start with the basics: how to store Monero safely.

Follow @MoneroOne on X and join the Resistance on Telegram (t.me/monero_one).

SOURCES

• The Record: Coinbase extortion attempt, company offers $20 million reward
• Help Net Security: Coinbase suffers data breach, gets extorted
• Coinbase: Protecting our customers, standing up to extortionists
• EUR-Lex: AMLR, Regulation (EU) 2024/1624, official text
• AMLR Article 79, Official Journal text mirror (Springlex)
• AMLR Article 90, entry into force and dates (Springlex)
• The Block: Coinbase CEO announces first arrest in India
• JPML: MDL No. 3153 transfer order
• OpenClassActions: Coinbase data breach class action
• Bloomberg Law: Coinbase customer service provider sued
• Coinbase: Q2 2025 shareholder letter (SEC)

Join the resistance in style: get Monero One at no cost. It stays free.