Coinbase discloses data breach; preliminary expenses estimated at $180 million to $400 million
Coinbase disclosed a material cybersecurity incident in which an unknown threat actor obtained customer account data and internal documents by paying contractors and employees in support roles outside the United States. The company preliminarily estimates expenses of $180 million to $400 million for remediation and voluntary customer reimbursements, and says the full impact is still being assessed, which matters to shareholders because the cost range is large and could change.
Key points
- Threat actor emailed Coinbase on May 11, 2025, demanding money in exchange for not disclosing the data; the company says it has not paid.
- Exposed data reportedly includes names, contact details, masked Social Security and bank account numbers, government ID images, and account balance and transaction history.
- Preliminary expense estimate of approximately $180 million to $400 million, before potential losses, indemnification claims, and recoveries.
- Company says customer funds and passwords or private keys were not compromised and it is cooperating with law enforcement.
The filing
Written by AI on Nov 8, 2026, 1:30 AM ET, from this filing only. Written later: this filing was briefed after the fact, when past filings were added to the site, so the brief may be read with hindsight; the filing itself is the record of what was known on May 15, 2025.
Briefs are written by AI from the filing text and can contain mistakes — open the filing before acting on anything. Impact (1-5) and tone are the AI's reading of the filing for shareholders, not a price forecast. Not investment advice.