<div id="readability-page-1"><div id="body"> A security researcher says Coinbase knew about a December 2024 security breach during which miscreants bribed its support staff into handing over almost 70,000 customers' details at least four months before it disclosed the data theft. The researcher, Jonathan Clark, says he knows this for a fact because he reported the attack to Coinbase on January 7 after the criminals tried to scam him. According to Clark, Coinbase's Head of Trust and Safety Brett Farmer responded to his &#34;comprehensive security report&#34; the same day he emailed it to the company's security@ address. In a blog about the incident, Clark says Farmer replied: &#34;This report is super robust and gives us a lot to look into. We are investigating this scammer now.&#34; And then, he says, he never heard another word from Coinbase, despite four follow-up emails sent in January. As a refresher: In May, Coinbase disclosed the breach to the US Securities and Exchange Commission. At the time, the company said the data thieves stole 69,461 people's private and financial information, including their name, date of birth, the last four digits of their Social Security number, address, phone number, email address, driver's license number, passport number, national identity card number, transaction history, balance, transfer, and the date customers opened their accounts. Coinbase said the breach took place on December 26, 2024, but wasn't discovered until May 11. The crooks also tried extorting the company for $20 million. Clark disputes this timeline, and says he was attacked on January 7 by scammers using detailed personal data he believes was stolen from Coinbase. It started with an email that had this subject line: A few minutes later, his phone rang and an &#34;American-sounding&#34; woman who claimed to be a Coinbase fraud prevention analyst told Clark that she was calling to confirm a large transfer from his account. &#34;What happened next was chilling,&#34; Clark said in a November 16 blog. &#34;She knew my social security number. She knew my Bitcoin balance down to the decimal point. She knew personal details that should have been impossible for a scammer to possess.&#34; Clark noted several red flags with this email and call. He asked the caller to prove she was from Coinbase, and she offered to read him his personal info - not to verify her own identity. The email was sent through Amazon SES (Simple Email Service) - not Coinbase's mail servers - and the caller claimed she could not send Clark an email from a verified Coinbase address. When he asked if he could call her back, she said that wouldn't work because she was &#34;in the fraud department.&#34; So he dialed the number that she had called him from and it was a Google Voice number. Finally, the caller wanted him to move his cryptocurrency to &#34;a cold wallet&#34; and started walking him through the process. &#34;This is a classic social engineering tactic - get the victim to move funds to an address controlled by the attacker,&#34; Clark wrote. After the call, when he logged into his Coinbase account, it didn't have any new login attempts or notifications about the fake transfer. <ul> <li>Coinbase extorted for $20M. Support staff bribed. Customers scammed. One hell of a SNAFU</li> <li>Coinbase confirms insiders handed over data of 70K users</li> <li>Chinese phishing kit helps scammers who send fake texts impersonate TikTok, Coinbase, others</li> <li>Ransomed CTO falls on sword, refuses to pay extortion demand</li> </ul> Clark says he emailed all of this, plus additional details, to the Coinbase security team on January 7, received the response from Farmer promising a probe, and then … nothing. He claims he followed up on January 13, 17, 22, and 29 and did not receive any responses. Then in May, Coinbase disclosed the intrusions. &#34;For four months, I had concrete evidence that attackers possessed detailed Coinbase customer data,&#34; Clark wrote. &#34;For four months, I repeatedly asked Coinbase to explain how this was possible. And for four months, my questions went unanswered.&#34; &#34;Coinbase never replied to a single follow-up email after Brett Farmer's initial response,&#34; he continued. &#34;Despite his promise that they were 'investigating this scammer,' the most important question - how the attacker obtained my private account data - was met with complete silence.&#34; The Register's inquiry to Coinbase was met with a similar silence, but we will update this story should that change. ® </div></div>

COIN

CONL

07311

Security researcher Jonathan Clark claims Coinbase knew about a December 2024 security breach four months before disclosing it. Clark reported the breach on January 7, but received no follow-up after an initial response. The breach involved bribed support staff and affected nearly 70,000 customers. Clark disputes Coinbase's timeline, stating he was targeted by scammers using stolen data in January. Coinbase disclosed the breach in May, revealing extensive customer data theft and a $20 million extortion attempt. The Register's inquiry to Coinbase remains unanswered.

- A security researcher claims Coinbase was aware of a December 2024 security breach involving the bribery of support staff to access nearly 70,000 customers' details four months before the company disclosed it.  
- Jonathan Clark reported the attack to Coinbase on January 7, receiving a prompt acknowledgment from the Head of Trust and Safety, but he alleges that his follow-up inquiries went unanswered until the breach was publicly disclosed in May.  
- The breach involved the theft of extensive personal information, and Clark argues that he provided evidence of the attack to Coinbase, which failed to address his concerns or explain how the attackers obtained sensitive data.

Security researcher calls BS on Coinbase breach disclosure timeline