CoinTracker Data Breach (2022): What Was Exposed & What To Do

In December 2022, CoinTracker, a crypto and NFT tax service, reported a data breach affecting a large share of its customer base. Public reporting placed the number of people affected at roughly 1.6 million. The company later linked the incident to a compromise at SendGrid, an email provider used by many organisations, in an attack that hit multiple SendGrid customers rather than CoinTracker alone.

The exposed data types named in reporting were email addresses and partial phone numbers. CoinTracker stated that the partial phone numbers did not originate from its own service. In a landscape where credential stuffing, phishing, and supply-chain compromises of common vendors remain routine, an incident of this kind matters because contact data can be reused quickly for targeted follow-on fraud, even when deeper financial records are not confirmed as taken.

Inside the incident

According to the reported summary, CoinTracker disclosed the breach in December 2022. The company said more than 1.5 million customers were impacted; the associated figure given for people affected is 1.6 million. CoinTracker attributed the event to a compromise of SendGrid, describing an attack that targeted multiple customers of that email provider.

Named exposed data types were email addresses and partially redacted phone numbers. CoinTracker advised that the partial phone numbers did not come from its service. Public detail does not describe the precise technical method used against SendGrid, the exact window of unauthorised access, or whether any other categories of data were involved. No specific threat group is attributed in the available facts.

How a breach like this happens

Incidents that involve a shared email or messaging vendor typically unfold as supply-chain or third-party compromises. An attacker gains access to the vendor’s systems or to customer accounts on that platform—often through stolen credentials, token theft, misconfigured access, or a vulnerability in the vendor’s infrastructure. Once inside, the attacker can pull contact lists, templates, or delivery logs that many client organisations store or process through the same service.

Because the vendor serves many companies, a single intrusion can expose data belonging to several unrelated customers at once. The client organisation may learn of the problem only after the vendor investigates or after unusual outbound mail or access patterns appear. This pattern is distinct from a direct break-in to the client’s own core databases; the exposure is real, but the root cause sits with a shared provider. No named group is tied to this specific case in the facts, and the precise path into SendGrid remains undisclosed here.

CoinTracker and its sector

CoinTracker is a service that helps users track cryptocurrency and NFT activity for tax and portfolio purposes. Companies in this sector commonly hold account identifiers, email addresses, transaction or wallet-related metadata, and sometimes phone numbers or other contact details needed for account recovery and notifications. They sit at the intersection of personal finance and digital assets, where users often maintain long-lived accounts and receive regular email about tax lots, balances, or security alerts.

A breach affecting contact data at such a service is consequential because the same email addresses are frequently used for exchanges, wallets, and banking. Even without confirmed exposure of private keys or full financial ledgers, harvested emails can be paired with public blockchain activity or other leaked datasets to craft convincing phishing or social-engineering attempts. The reliance on third-party email infrastructure is common across the sector, so vendor-level incidents can reach large customer populations quickly.

What was likely exposed

The facts name two data types as exposed: email addresses and partial phone numbers. CoinTracker stated that the partial phone numbers did not originate from its service. Exact contents beyond those named categories are unconfirmed in the public summary.

Organisations of this kind typically hold additional material—account names, support correspondence, tax-lot or transaction references, and similar records—but there is no confirmation in the given facts that those were taken in this incident. Readers should treat only the named types as reported and regard anything further as unconfirmed.

The real-world impact

For affected individuals, the primary concrete risks are phishing, smishing, and account-takeover attempts that use a known email address (and any partial phone information) to appear legitimate. Messages that reference crypto taxes, portfolio updates, or “urgent” security checks can be harder to dismiss when the sender already knows a working address tied to a CoinTracker account. Credential stuffing against other sites that share the same email is another practical concern if passwords were ever reused.

For the organisation, the incident involves customer notification, trust repair, and scrutiny of how third-party email services are configured and monitored. Because the company attributed the event to a multi-customer SendGrid compromise, the impact is shared with other SendGrid clients caught in the same attack, but CoinTracker still bears the customer-facing consequences for its own user base. No dollar loss figures or further operational details are provided in the facts.

If your data was in this breach

If you used CoinTracker around the time of the 2022 disclosure, treat your account email as known to unauthorised parties. Practical first steps include:

• Change passwords on your CoinTracker account and on any other important accounts that share the same email or password; enable multi-factor authentication where available.
• Treat unsolicited messages about crypto taxes, wallet access, or “breach assistance” with caution; verify through official app or website channels rather than links in email or text.
• Watch for unusual login attempts or password-reset emails on related financial and exchange accounts.
• Consider that partial phone data, even if not sourced from CoinTracker, can still support targeted SMS phishing; avoid replying to unexpected texts about accounts or funds.

You can run a free exposure scan of your email to check whether your information has surfaced in known breach data. That check does not reverse a past incident, but it helps you see whether the same address appears in other publicly reported sets and prioritise further hardening.

AICompiled with AI assistance from public sources and published under our editorial standards.