Coinbase has disclosed a serious data breach that compromised the personal information of nearly 70,000 users, reigniting debate over the risks associated with Know Your Customer (KYC) practices in the crypto industry.
Although the breach occurred in December 2024, it only came to light in May 2025. According to Cointelegraph, the incident was linked to outsourced customer support agents bribed to grant unauthorised access to user data.
The data leak included users’ full names, addresses, phone numbers, email accounts, partial Social Security numbers, masked bank details, images of government-issued IDs, and transaction records.
While passwords and crypto private keys remained secure, the incident highlights the vulnerabilities of storing large volumes of KYC data.
Coinbase responded by firing the implicated support staff, cutting ties with the third-party vendor involved, and reinforcing its internal security policies. Affected users have been offered a year of free credit monitoring and identity theft protection.
The breach has prompted renewed criticism of traditional KYC systems, with experts arguing that current protocols may increase user risk without effectively deterring bad actors. Some in the crypto community are pushing for privacy-preserving alternatives such as zero-knowledge proofs (ZKPs), which can verify identity without exposing personal data.
Advocates of this approach say it could enable compliance with regulatory demands while significantly improving user privacy and data security.
As the industry continues to face challenges in balancing regulation and privacy, the Coinbase breach stands as a cautionary example of how even well-established platforms remain vulnerable.
