{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:54:42.548Z",
  "tag": {
    "id": "coinbase",
    "label": "Coinbase",
    "isStack": false,
    "url": "https://pwn.watch/t/coinbase",
    "feed": "https://pwn.watch/t/coinbase/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "coinbase-bribed-support-agents-breach-may-2025",
      "title": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025",
      "json": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Coinbase customer support systems",
      "tags": [
        "coinbase",
        "crypto",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-05-11",
      "closedAt": "2025-05-30",
      "updatedAt": "2025-05-30",
      "summary": "Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.",
      "xPost": null
    },
    {
      "slug": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "title": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066",
      "json": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "tj-actions/changed-files GitHub Action",
      "tags": [
        "github-actions",
        "devtools",
        "tj-actions",
        "reviewdog",
        "github",
        "coinbase",
        "supply-chain",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-30066"
      ],
      "affectedVersions": [
        "tj-actions/changed-files through 45.0.7 (tags repointed March 14-15, 2025)"
      ],
      "fixedVersions": [
        "46.0.1 (see GitHub advisory GHSA-mw4p-6x4p-x5m5)"
      ],
      "startedAt": "2025-03-14",
      "closedAt": "2025-03-20",
      "updatedAt": "2025-03-20",
      "summary": "Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-15",
      "title": "Coinbase discloses the breach in an SEC filing and refuses the $20M ransom",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-11",
      "title": "Coinbase receives the extortion demand and discovers the breach",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05",
      "title": "Breach notice puts affected customers at 69,461",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-20",
      "title": "tj-actions and reviewdog maintainers finish remediation",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-18",
      "title": "CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-15",
      "title": "GitHub removes the action, then restores a cleaned repository",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "Coinbase agentkit runs the malicious action and leaks a write token (15:10 UTC)",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "All tj-actions/changed-files tags replaced with malicious commits (16:57 UTC); StepSecurity detects it",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-11",
      "title": "Malicious commit pushed to reviewdog/action-setup v1 tag",
      "body": "Reverted about two hours later.",
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-12-26",
      "title": "Unauthorized access begins (per breach notification)",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    }
  ]
}