On May 15, 2025, Coinbase—the world’s third-largest crypto exchange—revealed a sophisticated phishing breach that could cost up to $400 million in damages. While the technical infrastructure of their blockchain remained intact, the attackers never needed to touch it. Instead, they exploited something far older and more vulnerable: human trust and DNS-linked access points.
This incident isn’t just a Coinbase problem. It’s a warning to every crypto, DeFi, and Web3 platform: your weakest link may still be Web2.
Explore our full guide: Domain & DNS Security for Crypto, DeFi and Web3 Platforms
—
What Happened at Coinbase
Coinbase confirmed that rogue overseas support agents were bribed by cybercriminals, leading to a data breach that affected approximately 1% of its 9.7 million monthly users and exposed sensitive personal information including names, emails, phone numbers, addresses, partial Social Security numbers, and government-issued IDs. The stolen information enabled attackers to impersonate Coinbase in phishing campaigns targeting users.
No private keys or crypto funds were accessed directly. But the stolen data enabled attackers to launch highly targeted phishing campaigns, impersonating Coinbase and tricking users into transferring assets. According to Chainalysis, this type of attack has already cost the broader industry billions in cumulative losses.
The attackers demanded a $20 million ransom. Coinbase refused. Instead, the company is offering a $20 million bounty for information leading to the attackers’ arrest.
The result: between $180M and $400M in reimbursement and remediation costs, a 6% stock drop, and a scramble to relocate customer support back to the U.S. The reputational cost, however, may be even greater.
Coinbase’s Public Statement:
Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on <1% of Coinbase MTUs. No passwords, private keys, or funds were exposed. Prime accounts are untouched. We will reimburse impacted customers. More here: https://t.co/SidVn59JCV
— Coinbase 🛡️ (@coinbase) May 15, 2025
CEO Response: “We Said No to the Ransom”
Coinbase CEO Brian Armstrong publicly addressed the attack, reinforcing the firm’s refusal to negotiate with extortionists. He highlighted the grooming of support staff over several months, a classic example of slow social engineering at scale. This breach wasn’t a quick strike—it was a long play that exploited human weaknesses.
Armstrong’s transparency was applauded, but it also spotlighted how even top-tier crypto platforms are vulnerable when internal access isn’t tightly controlled. This incident reinforces a growing reality in Web3: threat actors don’t hack blockchains—they hack people.
https://t.co/evpIBMFvRW pic.twitter.com/f6UPdkL5R0
— Brian Armstrong (@brian_armstrong) May 15, 2025
The Real Attack Surface: DNS and Insider Risk
Crypto founders often assume their protocol is secure because their contracts are audited, but this mindset ignores real-world exploits. For example, despite rigorous contract audits, projects like Yearn Finance and Balancer still fell victim to DNS-based attacks that had nothing to do with on-chain code. These types of incidents show that security isn’t just about what happens on-chain.
Users don’t log in to smart contracts. They visit a domain name. They trust DNS. And DNS is still governed by centralized Web2 infrastructure.
Here’s what most projects overlook:
- DNS records can be hijacked if not secured with DNSSEC
- Domain registrars can be socially engineered or compromised
- Support systems (like CRMs and ticketing software) expose account-level data
Attackers don’t need to break the blockchain—they just need to look like you long enough to steal from your users. Once trust is lost, even temporarily, it’s hard to win it back.
What Could Have Prevented This?
Coinbase’s breach was a mix of insider risk and insecure infrastructure. Crypto platforms need to:
- Lock down domain access: Use registrar and registry locks to prevent unauthorized changes
- Implement DNSSEC: Authenticate DNS responses to prevent spoofing and cache poisoning
- Monitor DNS activity: Watch for suspicious record changes or clone sites with active monitoring tools
- Control internal access: Apply the principle of least privilege, track logins, use MFA, and revoke stale credentials
- Deploy phishing detection: Use AI-powered tools to scan for typosquatting and cloned domains
Without these measures, any project—regardless of size or notoriety—remains vulnerable to DNS-based social engineering exploits.
This Is Bigger Than Coinbase
In 2024 alone, $2.2 billion was lost to phishing, according to Chainalysis. And it’s not just Coinbase:
- Yearn Finance
- Balancer
- ETH.link
- MyEtherWallet
All have faced DNS or registrar-related breaches in recent years. Many of these breaches began the same way: with an unprotected or poorly managed access point at the domain level.
Social engineering and DNS exploitation are rising because they scale. Attackers don’t need to brute-force anything. They exploit trust.
Crypto projects often rely on third-party systems—domain registrars, outsourced support teams, DNS providers—without strong DNS policies or registrar safeguards. These operational gaps create a broad attack surface that few technical audits ever touch.
The Coinbase incident is a call to reframe our approach to crypto security. DNS, registrar, and insider risks are just as urgent as vulnerabilities in a smart contract or a wallet integration.
Five Lessons Every Crypto Team Needs to Apply Today
- Use Registry and Registrar Locks: Prevent unauthorized domain transfers or nameserver changes. This is the first layer of defense for domain integrity.
- Enable DNSSEC and Automate Key Rollovers: Ensure DNS responses are authenticated and immune to tampering. Automating rollovers prevents accidental outages and maintains continuous DNS integrity.
- Monitor Your Domain: Implement DNS monitoring to detect unauthorized changes, typosquats, or cloned domains early. Consider real-time alerting and integrations with your security stack.
- Vet Your Support Stack: Restrict support staff access based on role and geography. Monitor login activity, enforce MFA, and implement zero-trust principles.
- Educate Your Users: Train users to spot phishing attempts. Make it clear what your platform will and will not ask them to do. Include banner alerts, phishing simulations, and user-specific threat reports.
Conclusion: Crypto Security Starts at the DNS Layer
Coinbase did a lot right—they were transparent, refused to pay a ransom, and offered full reimbursement. But the breach still cost them up to $400M and shook customer trust. For a publicly traded company, that loss cuts deep.
Every project in Web3 should take note: smart contract audits are not enough.
If your DNS, registrar, or support systems are exposed, so is your community. Trust is the currency of decentralized systems. Without proactive DNS and domain protection, you’re gambling it away.
It’s time for crypto projects to shift left on DNS and Web2 access-point security.
🔗 Explore DomainSure’s Full DNS and Registrar Security Guide
Apply for a Domainsure Invite
Get a Free Domain Health Check
Due to high demand: allow up to 24 hours for report delivery.
