Coinbase data breach settlement? Not yet, but a lawsuit is pending

What happened in the Coinbase data breach

According to Coinbase's own filing with the SEC, on May 11, 2025 the company received an email from an unknown party claiming to hold information about certain customer accounts and internal documents, and demanding money to keep quiet. Coinbase said it did not pay. It said the party had paid several contractors or employees in support roles outside the U.S. to collect data from its internal systems, and that its own monitoring had caught improper access in the months before.

The data involved included names, addresses, phone numbers and emails, the last four digits of Social Security numbers, masked bank account numbers, government ID images, and account balance and transaction history. Coinbase said passwords and private keys weren't compromised and that the personnel involved never had access to customer funds. It estimated the cost of cleanup and voluntary customer reimbursements at $180 million to $400 million.

What the Coinbase data breach lawsuits claim

Class actions followed the disclosure, and on August 7, 2025 the Judicial Panel on Multidistrict Litigation combined them in the Southern District of New York as MDL No. 3153 (docket 1:25-md-03153) before Judge Edgardo Ramos. The defendants are Coinbase Global, Inc. and Coinbase, Inc. The Panel described the common questions as how and when the breach happened, whether Coinbase's data security was adequate, how and when it notified victims, and what harm resulted.

Those are allegations, not findings, and Coinbase hasn't been found liable. One detail from the Panel's later order matters for payouts: a plaintiff who says scammers tricked him into moving his crypto noted that, unlike many of the other plaintiffs, he can show an actual financial loss. Many people in a data breach class have exposed information but no out-of-pocket loss, which shapes what any eventual settlement looks like.

Who could be in a Coinbase class

The lawsuits seek to represent Coinbase customers whose personal information was exposed. No judge has certified a class, and there is nothing to join or sign up for, so don't let a website tell you otherwise. If a settlement is reached, notice would go to affected customers, typically by email, with instructions and a deadline.

To find out if you were affected, check your email for a notice from Coinbase, which said it warned customers whose information may have been accessed, and look in your account for security messages. Whatever happens, it helps to keep the breach notice email, screenshots of any odd account activity and records of money you lost or spent. Our guide to data breach settlement claims explains how these cases usually pay.

Is there a Coinbase data breach settlement? Where the case stands

As of mid-October 2026, the combined case is at an early stage. Two independent trackers that follow it report no class certification, no settlement and no claim form or deadline, and the Panel's own pending-MDL list dated October 1, 2026 still shows the case active before Judge Ramos. We couldn't open the court's docket directly, so check it before relying on anything here.

Why Coinbase's arbitration clause matters

Coinbase's customer user agreement has an arbitration provision, and the Panel's December 2025 order refers to Coinbase's forthcoming motion to compel arbitration of the MDL claims. If a judge sends customers' claims to arbitration, they would be pursued one by one rather than as a class, and a class settlement becomes less likely. If the judge refuses, the case can move toward class certification, and the court would then decide whether the customers can be treated as one group. Either way, expect months, not weeks.

That ruling is the biggest open question. Our explainer on arbitration clauses covers what they do, and the guide on how a class action lawsuit works shows where it fits in the process.

What you can do now

Nothing needs filing, but a few steps are worth taking:

• If you lost crypto to a scam: Coinbase said in its filing that it intends to reimburse eligible retail customers who sent funds to the threat actor as a direct result of the incident. Contact Coinbase support to ask about it, and keep screenshots, transaction records and messages.
• Secure your account: use an authenticator app or hardware key, never share codes, and treat any call, text or email claiming to be Coinbase with suspicion.
• Be careful with sign-up sites: some pages invite Coinbase users to hand their details to a law firm. One we reviewed says its fee would be 33% to 40% of any recovery. That's a lawyer sign-up, not a settlement claim.

Our guide to spotting settlement scams has more red flags.

How to hear about it if the case settles

Settlements in data breach cases typically take one to several years from filing, and some never happen. If one is reached, the administrator's site will carry the deadline and instructions. See how to get notified of class action settlements, or browse open cases in the settlements directory. Owed finds the settlements you qualify for, explains them in plain English, opens the official claim form and reminds you before the deadline. Owed Pro is $2 for the first week, then $49 per year — one flat membership. Owed never takes a percentage of any payout. See which settlements match you.

This article is general information, not legal or financial advice. Only a court can decide whether anyone is owed money in this case.

Glossary

Multidistrict litigation (MDL)

A procedure that combines similar federal lawsuits from different courts before one judge for pretrial work.

Motion to compel arbitration

A request asking a judge to send a dispute to private arbitration under a contract instead of keeping it in court.

Class certification

A judge's ruling that a lawsuit can proceed on behalf of a whole group. Until then, no one is officially in the class.

Out-of-pocket loss

Money you actually lost or spent because of the breach, as opposed to your data simply being exposed.

Threat actor

The security term for the person or group behind a cyberattack or extortion attempt.

FAQ