SendGrid Account Breach Was Used to Attack Coinbase, a Bitcoin Exchange
Nicole Perlroth / New York Times :
Context & Ripple Effects
This is the opening chapter of a pattern that would define Coinbase for a decade: attackers going after its customers through the people and systems around them rather than the exchange itself. The Times report that a compromised SendGrid account was turned against Coinbase was followed weeks later by Krebs on Security pinning down how it happened — a SendGrid employee's own account was hacked and used to steal customer credentials — making this a supply-chain breach, not a Coinbase failure per se.
What makes the story worth revisiting is how clearly the later coverage rhymes with it. Coinbase blocked over 1,100 customers from sending funds during the Twitter hack wave in 2020, then disclosed that a threat actor exploited a weakness in its SMS multi-factor authentication to drain 6,000 accounts, while user complaints about support failures centered on account takeovers — and by 2025, hackers had reportedly bribed customer-service staff for on-demand access to customer data.
First-order effects
- Coinbase customers receiving email through the hijacked SendGrid account faced convincing phishing that carried legitimate sender provenance, exactly the credential-theft vector the Krebs reporting confirmed.
- SendGrid took the direct reputational hit: a single employee account compromise became proof that its platform could be weaponized against other companies' users.
Second-order effects
- Email infrastructure providers faced pressure to harden internal account access, since one staffer's credentials were enough to impersonate trusted senders at scale.
- For Coinbase and other exchanges, third-party services like email delivery became part of the threat model — the same perimeter-blind spot that later showed up in its SMS-based authentication.
Third-order effects
- If the arc holds — phishing in 2015, SIM-adjacent MFA flaws in 2021, bribed insiders by 2025 — exchange security shifts from defending code to defending people, pushing operators toward hardware keys and zero-trust handling of customer data.
- Regulators and insurers increasingly treat account-takeover chains across vendors and staff as the core crypto-industry risk, not exchange-side hacking alone.
The trend: Attacks on cryptocurrency exchanges are migrating from technical exploits to identity-level vectors — vendor accounts, weak second factors, and bought insiders — with each incident forcing the industry's defenses up the human layer.