I have recordings proving Coinbase knew about breach months before disclosure

So the emails had proper DKIM signatures.

Did the support agents have the ability to send arbitrary emails from commerce@coinbase.com? If not, how did the scammers send a properly signed email?

You do realize that chatgpt has a very recognizable and irritating style, right?

That wouldn't surprise me — A few years ago I reported a vulnerability through their bug bounty program that allowed "mandatory" 2FA for crypto withdrawals to be bypassed.

They paid a pittance and permanently buried the report even though its release wouldn't have posed a risk anymore.

Talk to a lawyer about litigation.

I have a tradfi background but work in crypto with trading software.

The whole industry (except deribit) is a shit show of barely working apis that aren’t reliable or accurate in any way. It’s completely routine to not be able to get an order status for minutes at a time. Or to get fills after an order has been rejected. Or a week after a cancel confirmation message.

Coinbase is actually one of the worst offenders for this. Coinbase Prime, their supposed institutional grade offering especially so.

So it doesn’t surprise me at all that the same issues are happening more widely.

To be clear: deribit have always been efficient, accurate, reliable and generally excellent. If you must trade crypto, do it there so you’re Ops and Support people don’t have to suffer.

A related issue: often when there’s a security issue, the wrong people are blamed. In reality it is almost always the CEO’s fault for setting budgets or goals that are unrealistic and force everyone else to cut corners. Even other executives are a victim of this and are ultimately powerless.

Did they ever email customers that there was a data breach? I started getting scam messages about my Coinbase account in the beginning of the year and only realized they had a breach because I happened to see their post twitter. I dont remember getting notified about it though.

In July, 2025 I asked Coinbase to delete my account permanently, for which i had a bit of back-and-forth with customer service representatives, in the end I got an email confirming the deletion, then I tried to log into my account, I was still successful - they lied about it.

Then I reached out to customer service several times - no answer. Then I contacted dedicated channel for privacy related questions with all proofs of mishandling - radio silence.

It’s sad to see these companies mishandle our very personal data and get away with this.

Offshoring support for financial data should be illegal.

Even if they find the inside individuals, how could anyone ever present a legal case?

I remember Brian Armstrong saying something like "... and other data" when he communicated the data that was collected and then stolen. That tells a lot about him.