Coinbase is facing sharp criticism and regulatory pressure after confirming a significant data breach that exposed personal information of nearly 70,000 users.
According to a filing with the Maine Attorney General’s Office, the breach affected 69,461 individuals, of whom 217 were residents of Maine. The exchange also stated that the compromise affected less than 1% of its monthly active users.
Last week, the company revealed that a group of overseas support agents, bribed by cybercriminals, had leaked internal data. This sensitive information, including names, contact details, social security numbers, and identity documents, was later used to impersonate Coinbase staff in elaborate social engineering scams that were used to steal millions.
Following the breach, the attackers allegedly attempted to extort $20 million in Bitcoin from the exchange. Although Coinbase refused to pay, the scale of the breach remained unclear until the recent state-level disclosure.
Outdated KYC
Coinbase CEO Brian Armstrong said the stolen data had not appeared on the dark web. He argued that the attacker had little incentive to release it and pointed to a deeper issue of where regulatory pressures to collect large volumes of personal data.
He suggested that existing laws such as the Bank Secrecy Act (BSA) and anti-money laundering (AML) rules are outdated and potentially unconstitutional.
He added:
“My hope is there is a constitutional challenge to BSA/AML laws, or congress decides to review it at some point. We’re in a much different world than when it was enacted in 1970, and it arguably violates the fourth amendment, protecting us from unreasonable searches and seizures.”
Coinbase faces heat
Despite Armstrong’s claims, Coinbase faces increased public scrutiny and a reported federal investigation, following concerns about how it handled the situation.
The criticism intensified after crypto critic Molly White highlighted a new clause in the platform’s user agreement. The update, which took effect on May 15, just one day after Coinbase went public with the breach, restricts class action lawsuits and mandates arbitration in New York.
However, Armstrong defended the update, saying it was planned long before the breach. He also noted that the arbitration clause, including the class action waiver, was not new.
At the same time, a crypto security expert, Taylor Monahan, accused Coinbase of ignoring months of warnings about suspicious activity on the platform. She claimed that teams within the company dismissed credible alerts and failed to act until the breach became undeniable.
Monahan said:
“Every investigator under the sun has been feeding your various teams evidence of these insane thefts and insiders for over 6 months. We persisted even as your teams explicitly gaslit us, chasitized us for not being ‘polite enough, and called us toxic.”
