Coinbase's Understated Multi-Billion Dollar Data Breach
Description
A screenshot of a mobile webpage from the cryptocurrency exchange Coinbase. The header shows the Coinbase logo, a 'Sign up' button, and a hamburger menu icon. The visible text describes a security incident where attackers tried to extort Coinbase for $20 million, to which the company 'said no.' Below this, a heading 'What they got' is followed by a bulleted list of compromised data, which includes highly sensitive personally identifiable information (PII) like names, addresses, masked social security and bank account numbers, government ID images, account data, and internal corporate data. The meme's humor is derived from the caption '60b$ company btw', which sarcastically juxtaposes the company's massive valuation with a severe data breach that the official communication seems to downplay. It's a cynical take on corporate damage control and the recurring security lapses seen even in major tech and fintech companies
Comments
27Comment deleted
Their public statement reads like a change log where the breaking change is 'customer_trust' and the commit message is 'Minor refactor of our security perimeter.'
Sure, the hackers only got the last four of our SSNs - because in fintech threat modeling, security through partial printing is totally a defense-in-depth strategy
The attackers demanded $20 million in hush money, but Coinbase chose the cheaper option: letting their legal team handle the class action lawsuits while their engineers frantically rotate every API key and wonder if 'masked' SSNs with only 4 digits hidden really counts as 'secure' when there's only 10,000 possible combinations
When threat actors demand $20M to cover up a breach, Coinbase's response is the security equivalent of 'git push --force' to production on a Friday: bold, principled, and guaranteed to make everyone in the industry simultaneously respect and nervously laugh. Most companies would quietly pay and hope nobody notices - like sweeping technical debt under the rug - but Coinbase chose full transparency, proving that sometimes the best incident response is refusing to negotiate with attackers and letting your customers know exactly what happened. It's the 'we don't negotiate with terrorists' approach to cybersecurity, except now everyone knows your KYC data got pwned and you're hoping your breach disclosure game is stronger than your perimeter defense was
Nothing like a KYC-heavy data model to make 'limited corporate data' sound cute - when the $20M extortion email lands, the IR runbook deploys its strongest control: string_literal('We said no')
Nothing says "defense in depth" like masking SSNs and account numbers while leaking KYC scans, balances, and contact info - the exact inputs every IVR "security question" asks for; congrats, you've built the attacker's CRM
Hackers breach the DB demanding ransom; Coinbase drops a redacted schema dump instead - peak incident response transparency over opacity
government ID of all users ? Comment deleted
some users Comment deleted
https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists Comment deleted
as someone who has implemented veriff.com for a site, they can see all Comment deleted
webhooks with parsed data Comment deleted
images of the documents and you Comment deleted
even better, often times the "take a picture" part is actually a video, with sound and all Comment deleted
that's crazy Comment deleted
ikr, made me way more careful when verifying lol Comment deleted
I exclusively do ID verifications in the nude with well placed mirrors to make sure that if a human has to look at it, they regret it Comment deleted
+unshaved* Comment deleted
I use Coinbase 😭 Comment deleted
They say it's an inside job https://www.msn.com/en-us/money/markets/coinbase-says-scammers-bribed-insiders-to-steal-customer-data-and-it-could-cost-the-crypto-exchange-400-million/ar-AA1EQhi2 Comment deleted
Hi there, please, use English around devmeme, תודה מראש Comment deleted
the hell came last ? Comment deleted
this is Martian. Reads "toda merosh", translates "thanks in advance". Comment deleted
mea culpa. Fixed. Comment deleted
Thankfully I didn't get an email Comment deleted
Coinbase is a pain in the ass to use, literally anything else is more reliable. Its much more worth your time going through a crypto ATM then using coinbase. Comment deleted
Using coinbase is literally just setting yourself up to eventually getting simswapped. Comment deleted