XDRIPACADEMY
Sign in

Curriculum·F106 The Threat Model·60 min

Don't be a target

By the end of this lesson you can

  • Separate your exposure into what you control, what you delegated, and what is already public
  • Explain why invisibility is not achievable and what the realistic goal replaces it with
  • Apply address and identity hygiene so that a public transaction does not resolve to a person
  • Act correctly in the days after your data appears in someone else's breach
AutopsyThe Coinbase insider breach, disclosed May 2025$180M to $400M in estimated company cost, customer losses unquantified

Criminals bribed overseas support contractors to abuse their access and take customer records. It started around late December 2024. The ransom email arrived on 11 May 2025.

About 70,000 customers. No passwords, no private keys, no Prime accounts. What did go out: names, home addresses, phone numbers, government identity documents, account balances, transaction histories.

Coinbase refused the $20M demand and offered $20M for information leading to arrests instead. It put its own costs at $180M to $400M.

Read the list of what was taken again, because it is the point of this lesson. Individually, none of those fields is a key. Together they are something worse than a key: a priced target list, with a real name, a verified balance, and a front door.

The decision point does not belong to any customer. There was no setting to change and no habit that would have helped. The exposure was created by handing identity documents to a third party in order to be permitted to trade, then that party delegating support to a contractor, then an employee of the contractor taking a bribe.

Which means the title of this lesson is partly a lie, and we are going to deal with that first.

Primary source

You cannot make yourself untargetable. Anyone selling you that is selling something.

Some of your exposure was created before you started thinking about it, some of it is held by companies you will never meet, and some of it is legally required. The Coinbase customers did everything right and ended up on a list with their home addresses on it.

So the goal has to be something achievable instead, and it is worth stating precisely because the wrong goal produces years of pointless effort.

The pairing, not the visibility

An attacker needs two things joined together: an identity they can reach, and a balance worth reaching for.

Either one alone is close to harmless. Your name and address are already in a dozen places and produce nothing on their own. A wallet holding seven figures with no name attached is a number on a public ledger, and there are millions of those.

The pairing is what creates a target. And unlike visibility, the pairing is something you can influence, because most of it is assembled from things you did.

The realistic goal is not being invisible. It is being uncorrelated. You are raising the cost of joining your identity to your balance, and lowering the confidence of anyone who tries.

Sort your exposure into three buckets

Bucket one, what you control. What you post. Which addresses you reuse. Whether your public accounts connect to your holdings. Whether you talk about amounts. Whether the same handle appears on a forum, an exchange, and a domain registration.

Bucket two, what you delegated. Every KYC submission. Every custodian holding your identity next to your balance. Every service you gave a phone number and an address. You chose to hand these over, usually for a real reason, and you no longer control them. The autopsy is bucket two.

Bucket three, what is already public. Property records, company filings, old breaches, data brokers, whatever a search of your name returns. This bucket does not shrink.

Most people spend their effort on bucket three, which is fixed, and ignore bucket one, which is the only one that responds.

Bucket one, in order of value

Stop posting amounts, gains, screenshots and addresses. This is most of it. A screenshot of a gain converts you from an anonymous row in a dataset into a known holder, permanently and non-retractably. A leaked password can be changed. A post that established you hold cannot be unposted, because it was screenshotted and because search indexes are forever.

The F110-05 autopsy is what this escalates to in the worst case: verified physical coercion incidents reached 72 worldwide in 2025, up from 41 the year before, and the common precondition was that the attacker knew the person held.

Do not reuse addresses. A single reused receiving address turns every counterparty into someone who can see your entire balance and history. Use a fresh receiving address per counterparty; every modern wallet does this automatically if you let it.

Keep your tiers unlinked. F104's three-tier architecture only works if the tiers are not obviously the same person. If your vault funds your daily wallet directly and your daily wallet is publicly associated with you, then your vault is publicly associated with you and the architecture has bought you nothing.

Separate identities by context. A different handle and a different email for financial accounts than for the public account where you post opinions. Most correlation is done by matching a reused username across services, and it is done automatically.

Register domains and companies with privacy where the jurisdiction permits. Cheap, one-time, and it removes an address from a public database.

Worked example
How many parties hold the pairing on you

Count the organisations that currently hold your verified identity next to a known balance. Be honest and include the ones you stopped using.

A typical answer:

  • 3 exchanges you have used, all with KYC documents
  • 1 you signed up to years ago and forgot
  • 2 tax or accounting services
  • 1 hardware wallet vendor, if you gave a real shipping address
  • 1 broker or bank with crypto exposure visible

That is 8 parties. Now apply what the autopsy demonstrates: each one may delegate support to contractors, and each contractor employs people who can be bribed.

If each party independently has a 2 percent chance of a data exposure over five years, the probability that none of the eight leaks is:

0.98^8 = 0.851

So the probability that at least one does is:

1 - 0.851 = about 15 percent

At 5 percent per party, which is not obviously pessimistic given the last five years, it becomes:

1 - 0.95^8 = about 34 percent

Two things follow. First, this is not a tail risk you can dismiss; it is closer to a coin flip over a decade. Second, and more usefully, the number is driven by the count, not by the quality of any individual company. Closing the two accounts you no longer use is a larger risk reduction than anything you could do to harden the six you keep.

That is the practical instruction hiding in bucket two: you cannot secure them, so hold fewer of them. Close dormant accounts. Withdraw and close rather than leaving a balance and forgetting. Consolidate to the smallest number of custodians that meets your actual needs.

What a breach of your data actually means for you

When your details appear in someone else's breach, the danger is not usually direct theft, because passwords and keys are typically not in the dataset. The danger is that the next phishing attempt will be extremely good.

Assume the attacker knows your full name, address, phone number, which platform you use, and roughly what you hold. Every generic tell you were relying on stops working. A message that opens with your correct balance is not evidence of legitimacy, it is evidence that the sender bought a list.

Concretely, in the first week: change the password and rotate the second factor on the affected service, remove SMS recovery per F106-03, tell your household that convincing calls are coming, and expect the first wave within days rather than months. Withdrawing from the platform is not usually necessary and is often the panic move the follow-up attack is counting on.

Common misconception

I hold too little for anyone to bother targeting me.

This is the most common reason people skip this lesson, and it misunderstands who is doing the selecting.

Nobody chooses you. A list gets filtered, and the cost per attempt is close to zero, which F111-01 works out: the attacker's break-even sits somewhere near one success in two million. At that price there is no floor below which you are uninteresting.

There is also a compounding version. Small holders are frequently used as a first step: a compromised account of yours becomes the trusted channel through which someone with more is approached. You are not always the target. Sometimes you are the introduction.

The honest calibration is the reverse of the intuition. Being small does not remove you from the list. It changes what happens after you are on it, which is that the attempt against you will be automated rather than crafted, and automated attempts are the ones a written procedure defeats reliably.

What is proportionate

Do not over-rotate. Most of this list is cheap and permanent: stop posting amounts, do not reuse addresses, separate handles, close dormant accounts, use registration privacy.

The expensive measures, which are moving countries, avoiding all custodians, elaborate operational compartmentalisation, belong to a threat model most readers do not have. Return to F106-01's second question. Every one of those adds a failure mode, and F110 is full of people whose funds died with a level of secrecy their family could not penetrate.

The correct amount of this discipline is the amount that does not degrade over time, because the SEC autopsy in F106-03 is what happens to controls that are more effortful than the person maintaining them.

Key takeaway

You cannot be untargetable, and the Coinbase customers prove it: 70,000 people had their names, addresses, identity documents and balances taken through a bribe, with no setting they could have changed. So the goal is not invisibility, it is being uncorrelated, because what an attacker needs is an identity joined to a balance. Stop posting amounts and addresses, keep your tiers unlinked, separate your handles, and reduce the number of parties holding the pairing rather than trying to secure each one. Then, when your data does appear in someone else's breach, treat the next very convincing message as the expected consequence rather than as evidence.

These come back later

What is the realistic goal, if invisibility is impossible?
Not being findable, which you cannot control, but being uncorrelated: making it costly to link a real identity to a specific balance. You are lowering the quality of the pairing, not hiding.
Which pairing are you actually protecting?
Identity next to balance. Either alone is close to harmless. Together they produce a priced target, and that pairing is what breach corpora and public posts create.
What is the single most damaging thing you can post?
A screenshot of a gain, an address, or a balance. It converts you from an anonymous entry in a dataset into a known holder, and unlike a leaked password it cannot be withdrawn.

Sources and review

Confidence medium·Volatility high·Reviewed 2026-08-05·Owner unassigned

Contested

The $180M to $400M range is Coinbase's own estimate of remediation and reimbursement cost, not a measure of customer losses, which have not been comprehensively quantified. Do not present it as money taken from customers.

Whether increased on-chain privacy practice materially reduces individual targeting is not well evidenced either way. The mechanism is plausible and the countermeasures are cheap, but we should not claim a measured effect. Teach it as cost-raising, not as protection.

Track your progress

Create a free account to mark lessons complete and pick up where you left off.