New court filings in New York reveal that a data breach at Coinbase involved alleged complicity from employees at outsourcing firm TaskUs, with insiders reportedly selling sensitive customer information to criminal groups.
The amended class-action complaint, filed in the Southern District of New York, identifies TaskUs staff member Ashita Mishra as a central figure in a scheme that began in September 2024.
According to the filings, Mishra collected personal information from over 10,000 Coinbase accounts, including Social Security numbers, bank details, and transaction logs.
She reportedly photographed customer data on her phone, capturing up to 200 records per day, and recruited colleagues in a “hub-and-spoke” operation to pass the information to hackers.
Participants were often unaware of the full network, allowing the scheme to continue even if one insider was exposed.
The hackers, linked to a loose collective called ‘the Comm,’ allegedly used the stolen data to impersonate Coinbase staff and trick customers into revealing their crypto holdings.
Investigators estimate that TaskUs insiders earned at least $500,000 in bribes, with Mishra receiving $200 per data record.
The complaint claims that TaskUs dismissed around 300 employees in January 2025, including human resources personnel investigating the breach.
Plaintiffs say the company attempted to silence insiders who raised concerns and downplayed the incident to regulators.
The February Form 10-K filed by TaskUs reportedly omitted any reference to a material breach, even as the company pursued a $1.6 billion buyout deal with Blackstone.
Coinbase has consistently distanced itself from TaskUs, immediately notifying regulators and affected customers, reimbursing impacted accounts, tightening internal security, and ending its partnership with the vendor.
A Coinbase spokesperson stated the exchange refused to pay the criminals and instead established a $20 million reward for information leading to arrests and convictions.
Coinbase has characterised the actions of TaskUs staff as systemic, rather than isolated incidents, citing violations of Section 5 of the FTC Act on unfair practices.
Regulators are expected to examine whether adequate safeguarding measures were in place, such as encryption or multi-factor authentication, and assess the potential exposure of customers to identity theft or financial loss.
The case highlights the vulnerabilities of outsourcing critical customer services in the crypto industry, where exchanges manage both personal data and financial assets.
Analysts warn that, if proven, the allegations could influence how exchanges oversee offshore operations.
Previously, Binance and Kraken have faced similar social engineering threats, with hackers attempting to bribe employees to access sensitive information.
Binance reportedly used AI-driven monitoring to halt suspicious activity, while Kraken denied involvement, noting it had warned Coinbase about potential risks before the breach.
TaskUs, headquartered in Texas, has not responded to the latest allegations but maintains it has strengthened security protocols.
The mounting legal and regulatory scrutiny, combined with public attention on systemic failures, could have lasting effects on the company’s credibility as a trusted outsourcing provider.
The filings estimate that the breach resulted in losses between $180 million and $400 million and affected at least 69,000 Coinbase customers, emphasising the scale and severity of the insider-driven attack.
Meta is using AI in the US to detect teens who lie about their age and move them into safer Teen Accounts on Instagram, Facebook, and Messenger. The system adds stronger privacy settings and now asks parents to help confirm their child’s age.
WeatherlyRipple’s xrpl.js package was hit by a supply chain attack, risking private key theft from DeFi wallets. The XRP Ledger is unaffected, and a secure update has been issued. While no major losses are reported, the breach highlights a rising threat: are hackers now targeting open-source blockchain tools?
CatherineTrump Media & Technology Group has teamed up with Crypto.com and Yorkville America Digital to launch “America-First” ETFs via Truth.Fi, pending SEC approval. The funds will feature US securities and digital assets, backed by up to $250 million in capital from Trump Media.
KikyoSolana launched the free Game Pass NFT, giving players early access to Web3 games and rewards for completing in-game quests. Over 30,000 Game Pass NFTs have been minted, with future seasons planned to add more features and progression rewards.
AnaisNintendo is asking a California court to order Discord to unmask GameFreakOUT, the user accused of leaking confidential Pokémon content on the FreakLeak server. The company claims the materials were proprietary and is seeking the user's identity and contact information.
CatherineKakao has launched an AI service that quickly turns webtoons into short video previews, cutting production time from three weeks to three hours. The cost of creating these videos has dropped by 97%, from 2 million won to just 60,000 won.
WeatherlyElon Musk announced he will reduce his involvement with D.O.G.E starting in May, causing Tesla’s stock to rise 5% after the earnings call. This follows D.O.G.E's major federal cuts, affecting agencies tied to Musk’s companies. The key question is whether this shift will help Tesla recover from its tough financial quarter.
KikyoGoMining's Miner Wars gamifies Bitcoin mining by letting players use digital miner NFTs to earn Bitcoin rewards through its extensive mining infrastructure. The game has attracted over 245,000 active users and introduced features like clan leagues and welcome packs to boost engagement.
AnaisThe announcement follows a series of teasers shared on social media by both Ledger and Pudgy Penguins, hinting at a joint release described as “something cool and secure.”
CatherineOpenAI said it would consider buying Google’s Chrome browser if it is forced to sell it during the U.S. antitrust trial. The company also revealed it had asked Google for access to its search tools but was rejected, and now plans to build its own browser and search system.
Anais