Coinbase security record

An AWS cooling failure halted Coinbase trading for eight hours

Multiple chiller units failed at 7:20 PM ET in one AWS us-east-1 data hall, shutting down racks in availability zone use1-az4. Nearly all Coinbase trading stopped at 7:48 PM ET. Two of Coinbase's own design choices turned a single-zone provider fault into a platform outage: the Exchange matching engine ran in a placement group pinned to that one building with no automated cross-zone failover, so quorum was lost at 9:29 PM ET when three of five nodes went down; and a defect in AWS's managed Kafka service blocked partition-leader reelection, which stalled Coinbase's fee service and broke quoting. Quorum was restored at 12:06 AM ET on 8 May, cancel-only trading returned at 2:25 AM, all books reopened at 3:49 AM, the website and app were degraded from 5:30 AM and fully recovered at 9:53 AM, and the event-streaming backlog cleared at 2:00 PM. Coinbase published a detailed postmortem on 1 June 2026, called the duration unacceptable, said it had notified the relevant regulators within their required windows, and committed to warm cross-zone standby for matching engines and regular production failover exercises.

Coinbase engineering postmortem

Central Bank of Ireland fines Coinbase Europe 21.5 million euro

Three coding errors left five of the twenty-one scenarios in Coinbase Europe's transaction monitoring system failing to screen all transactions. Crypto addresses separated by special characters, for example, were skipped. The Central Bank found 30,442,437 transactions worth more than 176 billion euro went unmonitored for money laundering between 23 April 2021 and 19 March 2025, roughly 31% of the entity's volume. Coinbase fixed the errors within two to three weeks of finding them, but the regulator noted it took almost three years to finish re-running the affected transactions. That re-run flagged about 185,000 transactions for investigation and produced 2,708 suspicious transaction reports covering 13 million euro. The 21,464,734 euro fine reflects a 30% settlement discount off 30,663,906 euro.

Central Bank of Ireland press release

Coinbase authorised under MiCA by Luxembourg's CSSF

The Commission de Surveillance du Secteur Financier authorised Coinbase under the Markets in Crypto Assets regulation, letting it passport its full product set across all 27 EU member states from one licence. It unites the separate national registrations Coinbase had held in Germany, France, Ireland, Italy, the Netherlands and Spain, and makes Luxembourg its European hub in place of Ireland.

Coinbase announcement

Bribed support contractors leaked customer identity data

Criminals paid support contractors and employees working outside the United States to copy customer records from internal support systems. On 11 May 2025 they emailed Coinbase demanding money to keep the data quiet. Coinbase refused, disclosed the incident in an 8-K, fired the insiders and set up a $20 million reward fund for information leading to arrests instead. Names, addresses, phone numbers, email addresses, masked bank account numbers, the last four digits of social security numbers, government ID images, and balance and transaction history were taken. Passwords, private keys, 2FA codes and customer funds were not, and Prime accounts were untouched. Coinbase estimated $180 million to $400 million in remediation and voluntary reimbursements, and said it would repay eligible retail customers who sent funds to the attackers as a direct result. Its state breach filings, reported by SecurityWeek, put the number affected at 69,461 and date the first data theft to 26 December 2024.

Coinbase Global Form 8-K, 14 May 2025

SEC dismisses its case against Coinbase

The Commission filed a joint stipulation dismissing the June 2023 enforcement action against Coinbase Inc. and Coinbase Global Inc. It stated that the decision rested on its own move to reform crypto policy through the Crypto Task Force formed on 21 January 2025, and not on any assessment of the merits of the claims. No penalty was imposed and no change to Coinbase's business was required.

SEC press release 2025-47

UK FCA fines Coinbase's payments arm 3.5 million pounds

On 30 October 2020 CB Payments Limited voluntarily accepted a requirement barring it from onboarding customers the FCA classed as high risk. It then onboarded or served 13,416 such customers between October 2020 and 1 October 2023. Around 31% of them deposited roughly $24.9 million, which funded about $226 million of cryptoasset transactions through other Coinbase entities. The 3,503,546 pound penalty already reflects a 30% settlement discount, and was the FCA's first enforcement action under the Electronic Money Regulations 2011.

FCA press release

SEC sues Coinbase as an unregistered exchange, broker and clearing agency

The SEC alleged that since at least 2019 Coinbase had combined the functions of an exchange, a broker and a clearing agency without registering any of them, and had offered its staking-as-a-service program as an unregistered securities offering. It also named Coinbase Global Inc. as a control person. Coinbase disputed the claims, refused to settle and litigated. The case ran until February 2025 and ended in dismissal with no finding on the merits.

SEC press release 2023-102

New York regulator fines Coinbase $50 million for anti-money-laundering failures

The New York Department of Financial Services found long-running failures in customer due diligence, transaction monitoring and suspicious activity reporting. By late 2021 Coinbase had a backlog of more than 100,000 unreviewed transaction monitoring alerts, and the department found it routinely failed to investigate and report suspicious activity on time, sometimes filing months late. Coinbase paid a $50 million penalty and agreed to invest a further $50 million in compliance over two years. An independent monitor the department installed in early 2022 was kept in place for another year, extendable at the department's discretion.

NYDFS press release

Attackers drained at least 6,000 accounts through an SMS recovery flaw

Between March and 20 May 2021 attackers who already held phishing-harvested email addresses, passwords and phone numbers exploited a flaw in Coinbase's SMS account recovery process to obtain two-factor codes and move crypto off the platform. More than 6,000 customers were affected. Coinbase said it found no evidence the credentials came from Coinbase itself, updated the SMS recovery protocol to close the bypass, notified affected customers in a letter filed with the California Attorney General in September 2021, and credited each affected account with the full value of what was taken.

The Record, Recorded Future News

CFTC fines Coinbase $6.5 million over reporting and wash trading

The CFTC found that between January 2015 and September 2018 two Coinbase trading programs, Hedger and Replicator, matched orders with one another in certain pairs on the GDAX platform, producing trades between accounts Coinbase itself owned. That data went to Coinbase's website and on to reporting services, giving a false or misleading picture of volume and liquidity. The order also found that over roughly six weeks between August and September 2016 a former employee placed matching buy and sell orders in the litecoin bitcoin pair as wash trades, and held Coinbase vicariously liable. Coinbase paid a $6.5 million civil monetary penalty to settle.

CFTC press release 8369-21