CoinbaseCartel
Data as of August 16, 2026.
Credential exposure before the attack
41.4% of CoinbaseCartel victims whose domain we can identify (63 of 152) had employee credentials leak in the 12 months before CoinbaseCartel named them as a victim.
We don't know whether any of these credentials were how CoinbaseCartel gained initial access.
What industries CoinbaseCartel targets
Sector identified for 116 of 152 victims.
| Technology | 26 | |
| Manufacturing | 19 | |
| Financial Services | 15 | |
| Healthcare | 10 | |
| Logistics | 9 | |
| Construction | 7 | |
| Retail | 5 | |
| Telecommunications | 5 |
Where the victims are located
Country identified for 142 of 152 victims.
| United States | 58 | |
| United Arab Emirates | 9 | |
| France | 9 | |
| Canada | 8 | |
| United Kingdom | 7 | |
| Germany | 5 | |
| Japan | 4 | |
| Indonesia | 4 |
Most recent CoinbaseCartel victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Hitachi High-Tech hitachi-hightech.com | Manufacturing | Japan | Aug 14, 2026 |
| CEN and CENELEC cencenelec.eu | Non-profit | Belgium | Aug 3, 2026 |
| M. B. Kahn mbkahn.com | Construction | United States | Aug 3, 2026 |
| MIM Fertility mimfertility.ai | Healthcare | Poland | Aug 3, 2026 |
| XS CAD xscad.com | Construction | United Kingdom | Aug 3, 2026 |
| Accesso Technology Group accesso.com | Technology | United Kingdom | Jul 29, 2026 |
| Caterpillar caterpillar.com | Construction | United States | Jul 21, 2026 |
| Colliers colliers.com | Real Estate | Canada | Jul 21, 2026 |
| Axiom Global Technologies axiomglobal.com | Healthcare | United States | Jul 15, 2026 |
| Product AI product.ai | Technology | United States | Jun 8, 2026 |
| Cambridge Mobile Telematics cmtelematics.com | Financial Services | United States | Jun 3, 2026 |
| Panasonic Avionics panasonic.aero | Not identified | United States | May 22, 2026 |
| Openmind Networks openmindnetworks.com | Technology | Ireland | May 19, 2026 |
| Pragmatic Solutions pragmatic.solutions | Technology | United Kingdom | May 19, 2026 |
| Grafana Labs grafana.com | Technology | United States | May 18, 2026 |
| Zywave zywave.com | Financial Services | United States | May 18, 2026 |
| Buenos Aires Software bas.com.ar | Technology | Argentina | May 14, 2026 |
| Alpinion Medical Systems alpinion.com | Healthcare | South Korea | May 12, 2026 |
| Cass information Systems cassinfo.com | Logistics | Not identified | May 12, 2026 |
| Jozef Stefan Institute ijs.si | Not identified | Slovenia | May 12, 2026 |
Showing the 20 most recent of 152. Browse recent data breaches for more.
CoinbaseCartel leak sites
Addresses we've seen CoinbaseCartel publish victims from. Any .onion address needs the Tor Browser.
fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onionincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
CoinbaseCartel questions
Is CoinbaseCartel still active?
Yes. CoinbaseCartel posted its most recent victim on August 14, 2026. That's 8 victims in the last 30 days.
How many victims has CoinbaseCartel claimed?
CoinbaseCartel has named 152 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did CoinbaseCartel first appear?
The first victim we recorded for CoinbaseCartel was posted on September 16, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does CoinbaseCartel target?
Technology accounts for the most victims we can classify, with 26. Manufacturing follows at 19. We could identify a sector for 116 of 152 victims, so treat this as the shape of the targeting rather than a full census.
Has CoinbaseCartel already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.