CoinTracker Data Breach (2022)

On December 1, 2022, cryptocurrency tax and portfolio tracking service CoinTracker notified more than 1.6 million customers that their email addresses and partial phone numbers had been exposed in a breach traced to a compromise of the email delivery provider SendGrid.

Confirmed Breach Details

The primary disclosure on Have I Been Pwned states that the incident occurred in 2022 and affected 1.6M records. CoinTracker attributed the breach to an attack on SendGrid that hit multiple customers of the email-sending platform. The data exposed included email addresses and partial phone numbers; the company explicitly noted that the phone numbers did not originate from its own systems. The disclosure does not specify the exact date the attackers first accessed the data or whether any other information was taken.

SendGrid compromise served as the initial vector, allowing the threat actor to pull subscriber lists from CoinTracker and other organizations that relied on the service for transactional emails. No evidence of ransomware deployment or data encryption was reported, distinguishing this from typical extortion-style incidents.

Why This Matters for You and Your Family

If you used CoinTracker to track crypto holdings, prepare tax forms, or manage NFT transactions, your email address is now publicly listed on breach repositories and likely circulating among data brokers and fraud networks. Even partial phone numbers can be combined with other leaked records to reconstruct full contact details. For families, this risk extends beyond the account holder: spouses or children who share email threads, tax documents, or household financial apps may be indirectly exposed through the same address.

Crypto users are frequent targets because wallet addresses, exchange logins, and tax filings can reveal real-world identities and asset holdings. A single email from this breach can link your trading activity to your personal identity, increasing the chance of targeted phishing, SIM-swapping attempts, or fraudulent tax filings in your name.

Doxxing and Identity-Chain Risks

Email addresses act as universal connectors. Once published, attackers chain them with usernames from gaming platforms, social media handles, and older breaches to build detailed profiles. Partial phone numbers accelerate this process by confirming ownership of the email and enabling reverse lookups. The result is a doxxing chain that can expose home addresses, family member names, and even children’s online gaming accounts that reuse the same credentials or recovery emails.

Credential leaks of this type frequently cascade into account takeovers on exchanges, tax portals, and gaming services. Public reporting shows that once an email appears in a breach database, the average time until it is used in a follow-on attack is measured in weeks, not years.

What to Do

• Rotate the password used at CoinTracker anywhere it is reused and enable 2FA through an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same email or address.
• Let remediation specialists manage takedown requests across data brokers and leak sites on your behalf.

The CoinTracker breach illustrates how supply-chain attacks on widely used services can quietly expose millions of crypto users who assumed their tax and portfolio data remained private. Staying ahead requires more than one-time checks; it demands continuous visibility and expert intervention when new leaks surface. DoxxScan by GalaxyWarden delivers that edge through continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based doxxing chains.