A Coinbase data breach filing with the Maine Attorney General finally gives us some more detail than Coinbase’s vague “less than 1% of monthly transacting users”. 69,461 people were affected, and Coinbase says the data breach occurred on December 26, 2024.
It took them almost five months between the incident and the incident disclosure, although the company has since admitted it knew customer support agents were suspiciously accessing customer data as far back as January.
Security researchers who have spent months trying to call Coinbase’s attention to serious issues at the company are disputing Coinbase’s claims about the timing of the breach. “Threat actors had ongoing access via multiple insiders over a prolonged period of time.”
The SEC requires material cybersecurity incidents be disclosed within four business days; state laws often have a 30-day disclosure deadline. It’s not clear if customers outside the US were affected; if so, other disclosure laws may apply.
![As the SEC has dropped the majority of its ongoing lawsuits and investigations into cryptocurrency firms, most recently the Immutable web3 gaming company, a few firms seem to be getting a little nervous. Unicoin, a firm that announced shortly after Trump’s election that they would breach the 2024 “standstill” agreement they had reached with the SEC [I72] (and then did so), is now writing letters to the agency asking why their case has yet to be dropped. “We thought the war was over, and we said to the SEC, ‘Hey, we’re resuming our activity,’” explained Unicoin CEO Alex Konanykhin. Like some other industry executives, Konanykhin has gone beyond merely asking for an end to the enforcement case, and in his letter seeks retribution against the SEC employee who led the investigation into his company.14](https://storage.mollywhite.net/micro/f8b26d94775ddfc5a65c_Screenshot-2025-05-21-at-1.52.33---PM.png)
