SendGrid Account Breach Was Used to Attack Coinbase, a Bitcoin Exchange
SAN FRANCISCO — Hackers targeted SendGrid, a mass email service used by 180,000 companies including Uber, Pinterest, Spotify and Foursquare, to infiltrate Coinbase, one of the most popular Bitcoin exchanges.
Context & Ripple Effects
This is a supply-chain compromise story, not an exchange hack in the usual sense: attackers got into an account at SendGrid — a mass-email service whose 180,000 customers include Uber, Pinterest, Spotify and Foursquare — and used its legitimate sending infrastructure to reach Coinbase customers with mail that looked trustworthy. Weeks later, reporting on how the employee account was hacked to steal customer credentials confirmed the entry point was a single compromised login, not SendGrid's platform itself.
First-order effects
- Coinbase customers receiving phishing email from SendGrid's authenticated infrastructure face credential-theft attempts that standard spam filters and sender checks are poorly positioned to catch.
- SendGrid's entire enterprise base — not just Coinbase — must now treat every email from the vendor as potentially attacker-controlled until the account is contained.
Second-order effects
- Mass-email providers get pulled into their customers' threat models: buyers of email infrastructure begin demanding per-account isolation, auditing, and faster breach disclosure from vendors.
- For exchanges specifically, the incident foreshadows the pattern later seen when Binance lost ~$41M in bitcoin along with user API keys and 2FA codes — attackers stop targeting the exchange front door and go after credentials, keys, and communication channels around it.
Third-order effects
- If trusted-channel compromises keep working, exchanges are pushed toward authentication that doesn't depend on email or SMS at all — a shift underscored years later when a threat actor exploited Coinbase's SMS multi-factor authentication to steal from 6,000 customers, even after the exchange had shown it could block attacks like the one riding on Twitter's hack by intercepting over 1,100 attempted transfers.
- The structural lesson is that any widely-adopted SaaS provider becomes shared attack surface for all of its customers simultaneously, making vendor security posture a board-level procurement criterion rather than an IT detail.
The trend: Crypto exchanges are converging on a defense-in-depth posture — hardware-backed authentication, monitored channels, hardened vendor relationships — because attackers repeatedly enter through the trusted services surrounding the exchange rather than the exchange itself.