TaskUs Employee Accused Of Selling Coinbase Customer Data For Hundreds Of Thousands In Bribes
New court filings in New York reveal that a data breach at Coinbase involved alleged complicity from employees at outsourcing firm TaskUs, with insiders reportedly selling sensitive customer information to criminal groups.
The amended class-action complaint, filed in the Southern District of New York, identifies TaskUs staff member Ashita Mishra as a central figure in a scheme that began in September 2024.
How The Breach Unfolded And The Role Of Insider Conspiracy
According to the filings, Mishra collected personal information from over 10,000 Coinbase accounts, including Social Security numbers, bank details, and transaction logs.
She reportedly photographed customer data on her phone, capturing up to 200 records per day, and recruited colleagues in a “hub-and-spoke” operation to pass the information to hackers.
Participants were often unaware of the full network, allowing the scheme to continue even if one insider was exposed.
The hackers, linked to a loose collective called ‘the Comm,’ allegedly used the stolen data to impersonate Coinbase staff and trick customers into revealing their crypto holdings.
Investigators estimate that TaskUs insiders earned at least $500,000 in bribes, with Mishra receiving $200 per data record.
TaskUs Allegedly Attempted To Conceal The Scale Of The Breach
The complaint claims that TaskUs dismissed around 300 employees in January 2025, including human resources personnel investigating the breach.
Plaintiffs say the company attempted to silence insiders who raised concerns and downplayed the incident to regulators.
The February Form 10-K filed by TaskUs reportedly omitted any reference to a material breach, even as the company pursued a $1.6 billion buyout deal with Blackstone.
Coinbase has consistently distanced itself from TaskUs, immediately notifying regulators and affected customers, reimbursing impacted accounts, tightening internal security, and ending its partnership with the vendor.
A Coinbase spokesperson stated the exchange refused to pay the criminals and instead established a $20 million reward for information leading to arrests and convictions.
Systemic Failures And Regulatory Scrutiny Ahead
Coinbase has characterised the actions of TaskUs staff as systemic, rather than isolated incidents, citing violations of Section 5 of the FTC Act on unfair practices.
Regulators are expected to examine whether adequate safeguarding measures were in place, such as encryption or multi-factor authentication, and assess the potential exposure of customers to identity theft or financial loss.
Wider Implications For Crypto Industry Outsourcing
The case highlights the vulnerabilities of outsourcing critical customer services in the crypto industry, where exchanges manage both personal data and financial assets.
Analysts warn that, if proven, the allegations could influence how exchanges oversee offshore operations.
Previously, Binance and Kraken have faced similar social engineering threats, with hackers attempting to bribe employees to access sensitive information.
Binance reportedly used AI-driven monitoring to halt suspicious activity, while Kraken denied involvement, noting it had warned Coinbase about potential risks before the breach.
TaskUs Reputation And Future Challenges
TaskUs, headquartered in Texas, has not responded to the latest allegations but maintains it has strengthened security protocols.
The mounting legal and regulatory scrutiny, combined with public attention on systemic failures, could have lasting effects on the company’s credibility as a trusted outsourcing provider.
The filings estimate that the breach resulted in losses between $180 million and $400 million and affected at least 69,000 Coinbase customers, emphasising the scale and severity of the insider-driven attack.