[high] Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

Fri, 30 May 2025 00:00:00 GMT

Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-05-15: Coinbase discloses the breach in an SEC filing and refuses the $20M ransom (source)
2025-05-11: Coinbase receives the extortion demand and discovers the breach (source)
2025-05: Breach notice puts affected customers at 69,461 (source)

[critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs

Thu, 20 Mar 2025 00:00:00 GMT

Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.

Status: closed · Patch: patched · Fixed in: 46.0.1 (see GitHub advisory GHSA-mw4p-6x4p-x5m5)

Latest updates:

2025-03-20: tj-actions and reviewdog maintainers finish remediation (source)
2025-03-18: CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too
2025-03-15: GitHub removes the action, then restores a cleaned repository (source)

CVEs: CVE-2025-30066

pwn.watch: Coinbase incident updates

[high] Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

[critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs