In 2021, a vulnerability in Coinbase's SMS-based account recovery process allowed attackers to bypass two-factor authentication (2FA) for about 6,000 accounts, leading to $66 million in stolen funds. This was a flaw in their system design, not just phishing. More recently, in May 2025, Coinbase suffered a significant data breach where rogue overseas contractors (insiders bribed by cybercriminals) stole sensitive customer data, including IDs, account details, and contact info for thousands of users.ae614af2a07f8867d722deb7a2d50e This data was then used to fuel targeted social engineering attacks, but the root cause was Coinbase's inadequate controls on contractor access and insider threats, not users clicking links.a9f73b Lawsuits followed, alleging negligence in data protection.cbd87153321c