Coinbase Cartel
A data extortion operation first seen in September 2025 that steals data without encrypting systems. The sources reviewed show no link to the Coinbase exchange, and its posting fell sharply in the second quarter of 2026.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Bitdefender says the group steals data without encrypting it, which leaves systems running.1 Backups therefore do not remove the threat. Victims get 48 hours to respond and then 10 days to pay or negotiate, according to Bitdefender.1
Vendors disagree about the people behind it. Intrinsec assesses with high confidence that it is a rebrand of a short-lived operation called DataVault, and says it may not carry out intrusions itself, instead buying access in bulk and monetising data stolen by others.5 Hive Pro assesses it as an affiliate within Scattered Lapsus$ Hunters.2 Bitdefender says no link to ShinyHunters beyond contacts or infrastructure has been validated.1
ReliaQuest reports that the group's posts fell from 45 to 4 between quarters, the sharpest drop it tracked, and says no cause has been publicly confirmed.4 Hive Pro lists the UK among targeted regions, without detail,2 and no other source we reviewed mentions a UK link.
If the credential theory is right, the fix is mostly hygiene: remove old credentials and put MFA on file transfer and cloud systems. We would do that regardless of what happens to this brand.
How It Attacks
Details are thin. Intrinsec says few discriminating indicators have been identified.5
- 1
Obtain Access
Uses stolen credentials, access bought from brokers, exposed credentials and social engineering.
- 2
Gain Control
Obtains admin accounts and tools that can change system-wide settings.
- 3
Take the Data
Exfiltrates data and tampers with logs to reduce detection.
- 4
Extort
Names the victim on a leak site, sets deadlines and asks for payment in Bitcoin.
Key Techniques
Selected from Hive Pro's mapping.2 Hive Pro says some of its tradecraft reporting rests on a shared playbook with a wider cluster, not on direct observation, so we have left that out.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Uses credentials from infostealer logs. |
| T1199 | Trusted Relationship | Initial Access | Listed by Hive Pro as an access route. |
| T1566 | Phishing | Initial Access | Social engineering supports access. |
| T1070 | Indicator Removal | Stealth | Tampers with logs. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Listed by Hive Pro for data theft. |
| T1657 | Financial Theft | Impact | Extorts victims for Bitcoin. |
Defences That Matter
Remove Old Credentials
- Reset credentials that have appeared in infostealer logs, including old ones.
- Put phishing-resistant MFA on cloud, file transfer and remote access systems.
Reduce What Can Be Stolen
- Find and classify sensitive data on file transfer and cloud systems.
- Retire old data that nobody needs.
Plan for Extortion Without Encryption
- Rehearse a decision on a data-only demand with short deadlines.
- Agree in advance who speaks to customers and regulators.
Are Old Credentials Still Opening Doors?
We can help you find exposed credentials and reduce the data they can reach.
Sources
- Bitdefender: No Encryptors, No Problem: The Coinbase Cartel Ransomware Group, 9 February 2026
- Hive Pro: Coinbase Cartel: The Encryption-Free Data Extortion Group, TA2026194, 10 July 2026
- AhnLab ASEC: May 2026 Threat Trend Report on Ransomware, 19 June 2026
- ReliaQuest: Threat Spotlight: Ransomware and Cyber Extortion in Q2 2026, 16 July 2026
- Intrinsec: Coinbase Cartel: Behind the Noise of a Prolific Leak Operation, 25 June 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.