Underground Seller Claims 2.7 Million Records from Crypto App CoinTracker

A seller on an underground hacker forum says it has a database of more than 2.7 million CoinTracker users. CoinTracker is a popular crypto tax and portfolio app.

Security blogs reported the listing in December 2025. Even so, as of October 19, 2026, the company has not publicly confirmed any breach. Here is what is known, what is not, and what users should do.

Details of the Hacker’s Claims

The listing advertises 2,707,120 lines of data. Analysts say each line holds personal details, full names, birth dates, gender, home addresses, cities and ZIP codes. The data also reportedly holds email addresses, phone numbers and account status.

The size stands out. CoinTracker links to exchanges and wallets such as Coinbase, Binance and MetaMask to work out users’ taxes. One security firm, Brinztech, called 2.7 million records a significant share of the company’s users.

The reports reviewed do not name the seller. They also do not give a price or explain how the seller got the data. Meanwhile, analysts say nothing in the listing points to API keys or portfolio balances. Even the firm that reported the listing says it cannot vouch for outside claims.

The Forum Listing Remains Unconfirmed

CoinTracker has not confirmed that the listing is real. A review of its blog turned up no statement about this claim.

However, the company has addressed a similar problem before. In December 2022, a breach at email provider SendGrid exposed CoinTracker user emails. Have I Been Pwned lists about 1.6 million accounts in that case.

CoinTracker said its own database was not breached. Further, it reported that the document contained phone numbers even though the company never collects phone numbers. In fact, it ran the phone numbers against real users who voluntarily provided their numbers; there was no match.

The blog post still states this after its update in February 2026. Similarly, CoinTracker Support claimed in a post published in July 2024 that there has been no instance of breach involving passwords, financial data, API keys, and accounts.

Why Some Details Raise Doubts

That history matters here. The new listing reportedly includes phone numbers. Yet CoinTracker says it does not collect them. The company could have changed its practices since then. Still, nothing reviewed shows that it did.

The analyst note adds more reasons for doubt. The newest sample records date as far back as early 2025. Also, the fields resemble generic profile exports rather than typical crypto tax account data. Therefore, the data could be old or labeled incorrectly.

Other listings fit that pattern. This summer, the security firm SOCRadar flagged a seller offering millions of records from many crypto services. CoinTracker was one of them, alongside Coinbase, Gemini, Robinhood and Ledger. That file supposedly contained first names, last names, email addresses, phone numbers, country, and a “Source” field. Such a database appears to be an aggregate marketing lead list.

This is not to say that these two listings contain the same datasets. Still, it shows how sellers can recycle information under a famous name. If the data is real, the risk is high. Crypto holders make attractive targets. A name, phone number and address help criminals in several ways.

For example, scammers can pose as CoinTracker or the IRS. Fake tax notices look more believable to people who use a tax app. Others can try a SIM swap. In that attack, a thief tricks a phone carrier into moving your number to a new SIM card. Then the thief can read your text-message codes.

Stolen tax documents can create similar risks, as criminals may use exposed personal and financial information to support fraud attempts. Home addresses also raise the chance of physical threats, although that remains only a possibility.

Next Step for Users

Data breaches are almost a daily occurrence these days, and that might not change anytime soon. But people can protect themselves by applying simple security habits.

First, don’t click on links in messages about your account. Open a new tab and type the website address yourself, just to be safe. If you get a message that’s trying to rush you into action, pause for a second. Take your time.

Switch over from text-message codes and use an authenticator app or a hardware key instead. That’s much safer. Also, call your mobile carrier and ask them to set up a port-out PIN or a number lock.

Take a look at the exchange keys you’ve connected to CoinTracker. The app can only see your balances; it can’t actually move your money. Still, make sure every key is set to read-only, and withdrawals are disabled. Clean up and remove any keys you’re not using.

If you’re worried someone knows your birth date and address, freezing your credit is a good option. Freezes are free in the United States.

Three things would settle the question. An official response from CoinTracker would help most. Independent researchers could compare the sample data to actual accounts to see if the claims are real. Breach-alert services, like Have I Been Pwned, might add the data too.

Until someone proves the breach, just stay cautious and follow these steps. They cost little, and they protect against many scams, not only this one.