A data-theft-only extortion group
CoinbaseCartel is an extortion group that steals data and threatens to publish it, rather than encrypting systems. It describes its operations as never involving system encryption or operational disruption. SOCRadar first identified its Tor leak site on 15 to 16 September 2025, when the group posted its first batch of claimed victims at once.
According to SOCRadar and Halcyon, victims are given 48 hours to make contact and then 10 days to pay or renegotiate, with ransoms accepted only in Bitcoin. Leak site entries move through three statuses: Active, Leaking and Leaked. An auctions section added in early 2026 lets third parties bid on stolen datasets, and a partnerships section offers fixed-fee and revenue-sharing deals to people who can show evidence of an existing compromise.
How it gets in
Researchers at SOCRadar identify stale infostealer logs as the dominant initial access vector, with credentials harvested by families such as RedLine, Lumma and Vidar reused against corporate cloud environments, FTP and SFTP servers and managed file transfer services. Halcyon also lists vishing, OAuth application abuse, exposed credentials in cloud repositories and attempts to recruit insiders. No CVEs have been attributed to the group. In late 2025 the group advertised a budget of more than $2 million for zero-day exploits.
The numbers, and their limits
As of 19 October 2026, ransomware.live lists 207 claimed CoinbaseCartel victims, with the most recent posting on 23 August 2026. By country, the United States accounts for 76, followed by Germany and the United Arab Emirates with 12 each, France with 11 and the United Kingdom with 10. By sector, ransomware.live counts technology at 63, professional services at 30, manufacturing at 25, and retail and e-commerce and financial services at 18 each.
These are the group's own claims. Halcyon notes that unverified claims, denials and re-uploads inflate the raw numbers, and that at least two claims were taken down after the named organisations denied being breached. It also reports that new listings slowed after April 2026.
The Scattered LAPSUS$ Hunters question
Some researchers track CoinbaseCartel under the alias "shinysp1d3r" and suggest a connection to ShinyHunters, Scattered Spider and LAPSUS$, the ecosystem known as Scattered LAPSUS$ Hunters. SOCRadar describes this as a contested hypothesis that has not been validated beyond superficial operational overlaps. Halcyon assesses ties based on overlapping techniques, shared affiliate pools and a shared domain, but says there is no confirmed personnel or codebase link to any predecessor group. The link should be treated as unconfirmed.
Key points
- CoinbaseCartel steals data and extorts victims without encrypting systems; it appeared in mid-September 2025.
- ransomware.live lists 207 claimed victims as of 19 October 2026, 76 of them in the US, with the latest posting on 23 August 2026.
- Researchers say raw victim counts are inflated by unverified claims, denials and re-uploads.
- Reused infostealer credentials are reported as the main access route; the group advertised a $2 million-plus zero-day budget in late 2025.
- A link to the Scattered LAPSUS$ Hunters ecosystem has been suggested but not confirmed.
Further reading & sources
- Ransomware.live: coinbasecartel (ransomware.live)
- Dark Web Profile: CoinbaseCartel (SOCRadar)
- CoinbaseCartel (Halcyon)