A Coinbase data breach filing with the Maine Attorney General finally gives us some more detail than Coinbase’s vague “less than 1% of monthly transacting users”. 69,461 people were affected, and Coinbase says the data breach occurred on December 26, 2024.

It took them almost five months between the incident and the incident disclosure, although the company has since admitted it knew customer support agents were suspiciously accessing customer data as far back as January.

Security researchers who have spent months trying to call Coinbase’s attention to serious issues at the company are disputing Coinbase’s claims about the timing of the breach. “Threat actors had ongoing access via multiple insiders over a prolonged period of time.”

The SEC requires material cybersecurity incidents be disclosed within four business days; state laws often have a 30-day disclosure deadline. It’s not clear if customers outside the US were affected; if so, other disclosure laws may apply.

It's interesting to me that the Fifth Circuit only considered "control" at the smart contract level, and does not seem to consider the role of validators in their opinion. A substantial portion of ETH blocks are built with relays that censor transactions with OFAC-sanctioned contracts, and it seems to me there is now an open question as to whether validators that use non-censoring relays could be sanctioned directly.

(Not saying they should, just remarking on the fact that it seems to have gone completely unaddressed.)

Of course this was a concern already, but what with the Treasury focused on the Tornado Cash contracts, it was less central than I suspect it might be soon. This strategy would be somewhat in keeping with legal theories around other "malicious" code, where it's broadly speaking legal to write a devastating computer virus, but a whole lot less legal to run one.

The Fifth Circuit has just opined that the smart contracts that comprise the Tornado Cash cryptocurrency tumbler are "not property because they are not capable of being owned", and thus cannot be sanctioned by OFAC.

Full opinion

I must once again urge you: please do not record your abortions on the blockchain.

There are a lot of very worried people right now, fearful of an impending regime that may well crack down on things like reproductive care, gender-affirming care, or the ability for immigrants to even continue to remain in the US. Some have suggested people get familiar with cryptocurrencies in the event they might have to circumvent an authoritarian state.

I’ve said it before and I’ll say it again: in very bad situations, bad solutions can sometimes still be better than nothing. I make no secret of my views on the cryptocurrency industry, but I am the last to judge a person for using whatever means they have available to them to take care of themselves and others.

But please remember that most popular cryptocurrencies use public ledgers, where every transaction is visible to anyone who cares to look (no warrant required), where true anonymity is extremely challenging, and where tracing technology is getting only more sophisticated. Popular on-ramps like Coinbase and Gemini and other exchanges require customers to provide similar kinds of identification as banks, linking your future transactions to your real-life identity. (And many of these companies have thrown themselves wholeheartedly behind Trump, by the way, despite their “anti-authoritarian” claims). 

There are cryptocurrencies that are more anonymous than the bitcoins and ethereums of the world (privacycoins like Monero and Zcash for example), though there are still attempts to trace these types of tokens and you have to be knowledgeable and very cautious about how you use them so as not to inadvertently reveal your identity.

If you’re in a bad situation, do whatever it is you need to do. I’m certainly not going to judge you. But please be very cautious, and be highly skeptical of anyone who presents cryptocurrency as a magic solution to authoritarianism.

Further reading: “Abuse and harassment on the blockchain”, “Anonymous cryptocurrency wallets are not so simple”

PSA: Paying for a subscription on the crypto version of OnlyFans using a public blockchain does not give you "true privacy", regardless of what the models there might say.

"it's all stored locally" is not a panacea for these alarming privacy-invading products!

what exactly is stored locally? what data is extracted from that local data and sent to the company's servers? is that local data being backed somewhere?

what additional risks are now being posed to people who share devices, whose devices might be accessed by others or compromised, or who might not realize these tools are running? what is the risk that the company might later change its decision on local storage?

back in my day we called this spyware

"have you ever wanted to install a keylogger to spy on your spouse or kid? well have we got news for you"

hi hello i see it's time for our semi-regular reminder that your browser's incognito mode does not protect you from surveillance!