Criminals bribed overseas support contractors to abuse their access and take customer records. It started around late December 2024. The ransom email arrived on 11 May 2025.
About 70,000 customers. No passwords, no private keys, no Prime accounts. What did go out: names, home addresses, phone numbers, government identity documents, account balances, transaction histories.
Coinbase refused the $20M demand and offered $20M for information leading to arrests instead. It put its own costs at $180M to $400M.
Read the list of what was taken again, because it is the point of this lesson. Individually, none of those fields is a key. Together they are something worse than a key: a priced target list, with a real name, a verified balance, and a front door.
The decision point does not belong to any customer. There was no setting to change and no habit that would have helped. The exposure was created by handing identity documents to a third party in order to be permitted to trade, then that party delegating support to a contractor, then an employee of the contractor taking a bribe.
Which means the title of this lesson is partly a lie, and we are going to deal with that first.
You cannot make yourself untargetable. Anyone selling you that is selling something.
Some of your exposure was created before you started thinking about it, some of it is held by companies you will never meet, and some of it is legally required. The Coinbase customers did everything right and ended up on a list with their home addresses on it.
So the goal has to be something achievable instead, and it is worth stating precisely because the wrong goal produces years of pointless effort.
The pairing, not the visibility
An attacker needs two things joined together: an identity they can reach, and a balance worth reaching for.
Either one alone is close to harmless. Your name and address are already in a dozen places and produce nothing on their own. A wallet holding seven figures with no name attached is a number on a public ledger, and there are millions of those.
The pairing is what creates a target. And unlike visibility, the pairing is something you can influence, because most of it is assembled from things you did.
The realistic goal is not being invisible. It is being uncorrelated. You are raising the cost of joining your identity to your balance, and lowering the confidence of anyone who tries.
Sort your exposure into three buckets
Bucket one, what you control. What you post. Which addresses you reuse. Whether your public accounts connect to your holdings. Whether you talk about amounts. Whether the same handle appears on a forum, an exchange, and a domain registration.
Bucket two, what you delegated. Every KYC submission. Every custodian holding your identity next to your balance. Every service you gave a phone number and an address. You chose to hand these over, usually for a real reason, and you no longer control them. The autopsy is bucket two.
Bucket three, what is already public. Property records, company filings, old breaches, data brokers, whatever a search of your name returns. This bucket does not shrink.
Most people spend their effort on bucket three, which is fixed, and ignore bucket one, which is the only one that responds.
Bucket one, in order of value
Stop posting amounts, gains, screenshots and addresses. This is most of it. A screenshot of a gain converts you from an anonymous row in a dataset into a known holder, permanently and non-retractably. A leaked password can be changed. A post that established you hold cannot be unposted, because it was screenshotted and because search indexes are forever.
The F110-05 autopsy is what this escalates to in the worst case: verified physical coercion incidents reached 72 worldwide in 2025, up from 41 the year before, and the common precondition was that the attacker knew the person held.
Do not reuse addresses. A single reused receiving address turns every counterparty into someone who can see your entire balance and history. Use a fresh receiving address per counterparty; every modern wallet does this automatically if you let it.
Keep your tiers unlinked. F104's three-tier architecture only works if the tiers are not obviously the same person. If your vault funds your daily wallet directly and your daily wallet is publicly associated with you, then your vault is publicly associated with you and the architecture has bought you nothing.
Separate identities by context. A different handle and a different email for financial accounts than for the public account where you post opinions. Most correlation is done by matching a reused username across services, and it is done automatically.
Register domains and companies with privacy where the jurisdiction permits. Cheap, one-time, and it removes an address from a public database.
Count the organisations that currently hold your verified identity next to a known balance. Be honest and include the ones you stopped using.
A typical answer:
- 3 exchanges you have used, all with KYC documents
- 1 you signed up to years ago and forgot
- 2 tax or accounting services
- 1 hardware wallet vendor, if you gave a real shipping address
- 1 broker or bank with crypto exposure visible
That is 8 parties. Now apply what the autopsy demonstrates: each one may delegate support to contractors, and each contractor employs people who can be bribed.
If each party independently has a 2 percent chance of a data exposure over five years, the probability that none of the eight leaks is:
0.98^8 = 0.851
So the probability that at least one does is:
1 - 0.851 = about 15 percent
At 5 percent per party, which is not obviously pessimistic given the last five years, it becomes:
1 - 0.95^8 = about 34 percent
Two things follow. First, this is not a tail risk you can dismiss; it is closer to a coin flip over a decade. Second, and more usefully, the number is driven by the count, not by the quality of any individual company. Closing the two accounts you no longer use is a larger risk reduction than anything you could do to harden the six you keep.
That is the practical instruction hiding in bucket two: you cannot secure them, so hold fewer of them. Close dormant accounts. Withdraw and close rather than leaving a balance and forgetting. Consolidate to the smallest number of custodians that meets your actual needs.
When your details appear in someone else's breach, the danger is not usually direct theft, because passwords and keys are typically not in the dataset. The danger is that the next phishing attempt will be extremely good.
Assume the attacker knows your full name, address, phone number, which platform you use, and roughly what you hold. Every generic tell you were relying on stops working. A message that opens with your correct balance is not evidence of legitimacy, it is evidence that the sender bought a list.
Concretely, in the first week: change the password and rotate the second factor on the affected service, remove SMS recovery per F106-03, tell your household that convincing calls are coming, and expect the first wave within days rather than months. Withdrawing from the platform is not usually necessary and is often the panic move the follow-up attack is counting on.
I hold too little for anyone to bother targeting me.
This is the most common reason people skip this lesson, and it misunderstands who is doing the selecting.
Nobody chooses you. A list gets filtered, and the cost per attempt is close to zero, which F111-01 works out: the attacker's break-even sits somewhere near one success in two million. At that price there is no floor below which you are uninteresting.
There is also a compounding version. Small holders are frequently used as a first step: a compromised account of yours becomes the trusted channel through which someone with more is approached. You are not always the target. Sometimes you are the introduction.
The honest calibration is the reverse of the intuition. Being small does not remove you from the list. It changes what happens after you are on it, which is that the attempt against you will be automated rather than crafted, and automated attempts are the ones a written procedure defeats reliably.
What is proportionate
Do not over-rotate. Most of this list is cheap and permanent: stop posting amounts, do not reuse addresses, separate handles, close dormant accounts, use registration privacy.
The expensive measures, which are moving countries, avoiding all custodians, elaborate operational compartmentalisation, belong to a threat model most readers do not have. Return to F106-01's second question. Every one of those adds a failure mode, and F110 is full of people whose funds died with a level of secrecy their family could not penetrate.
The correct amount of this discipline is the amount that does not degrade over time, because the SEC autopsy in F106-03 is what happens to controls that are more effortful than the person maintaining them.
You cannot be untargetable, and the Coinbase customers prove it: 70,000 people had their names, addresses, identity documents and balances taken through a bribe, with no setting they could have changed. So the goal is not invisibility, it is being uncorrelated, because what an attacker needs is an identity joined to a balance. Stop posting amounts and addresses, keep your tiers unlinked, separate your handles, and reduce the number of parties holding the pairing rather than trying to secure each one. Then, when your data does appear in someone else's breach, treat the next very convincing message as the expected consequence rather than as evidence.