CoinbaseCartel: 190 victims, no encryption, just data theft
CoinbaseCartel is a data-theft-only extortion group that steals corporate data and threatens to publish it unless victims pay. The operation does not encrypt systems or disrupt operations; it exfiltrates files and lists victims on a Tor-based leak site. The group has been active since September 2025 and has claimed 190 victims across 12+ industries, including aerospace, healthcare, financial services, and government & defense.
The name carries no connection to the legitimate Coinbase crypto exchange. CoinbaseCartel is part of the Scattered Lapsus$ Hunters (SLSH) collective, which also includes ShinyHunters, Scattered Spider, and Lapsus$ affiliates. The group draws from the same ecosystem and shares infrastructure, including a domain and overlapping TTPs, with its affiliates.
How CoinbaseCartel operates: infostealer logs to DLS
The attack chain starts with infostealer malware logs. RedLine, Lumma, and Vidar steal credentials from victim endpoints, and CoinbaseCartel uses those compromised pairs to access corporate systems directly. No additional malware is dropped on the victim side; the operation performs pure data exfiltration rather than deploying a second-stage payload.
The leak site runs on Tor at fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion. Victims appear under one of three statuses: Active, Leaking, or Leaked. A dedicated partnerships intake page on the DLS handles fixed-fee and revenue-sharing deals, requiring partners to submit a proposal with evidence of an existing compromise.
Recent high-profile hits: 15 new victims in 30 days
CoinbaseCartel has added 15 new victims in the last 30 days, with the most recent batch hitting the DLS on July 14, 2026. The latest wave includes Axiom Global, Demand.io, and Cambridge Mobile Telematics, all US-based, followed by Caterpillar and Colliers Real Estate on July 20, and PanasonicAero on July 15.
The July 28 batch brings Accesso, a UK software firm, alongside M.B. Kahn Construction, CEN/Cenelec, and MIM Fertility. CEN/Cenelec is a Belgian standards body, making it one of the more unusual targets in the group’s recent run. M.B. Kahn Construction and MIM Fertility round out the UK and US entries from that date.
The 15-victim stretch spans from June 12 through July 28, 2026. Demand.io and Cambridge Mobile Telematics both landed on June 12, with CMT appearing again on June 2 and 5 as separate listings. Axiom Global, Caterpillar, and Colliers follow in mid-July, with PanasonicAero on the 15th and Accesso closing the run on the 28th.
Who's been hit: 190 victims across 34 countries
CoinbaseCartel has claimed 190 victims across 34 countries, up from 100 in April 2026. The US leads with 71 victims, followed by the UAE (12), Germany (11), and the UK and France (10 each). The remaining 152 victims are spread across the other 29 countries.
Technology dominates the sector breakdown with 56 to 63 victims, depending on the tracker. Business Services follows with 21 to 30, then Manufacturing at 17 to 25, and Consumer Services at 17. Healthcare rounds out the top five. The full roster spans 12 industries: Aerospace, Agriculture and Food Production, Business Services, Construction, Consumer Services, Engineering, Finance, Financial Services, Government & Defense, Healthcare, Manufacturing, and an "Other" bucket for the long tail.
The SLSH connection: ShinyHunters, Scattered Spider, Lapsus$ ties
CoinbaseCartel is a splinter from the Scattered Lapsus$ Hunters (SLSH) collective, a loose affiliate ecosystem that also includes ShinyHunters and Scattered Spider. The group functions as a data-theft-led extortion variant, distinct from the full-encryption ransomware its parent groups typically deploy. No confirmed personnel or codebase link exists to any predecessor outfit, but the operational overlap is consistent with a fork rather than a copy.
The connection is supported by shared infrastructure, including a common domain, and overlapping TTPs across the three affiliates. Both ShinyHunters and Scattered Spider have been identified as CoinbaseCartel affiliates in the same campaign wave. The custom tooling matches UNC6040 and UNC6240 activity clusters tracked in the broader ShinyHunters campaign, which places the group in the same tooling lineage as the other SLSH members.
The extortion pattern is a two-stage repeat: victims pay an initial ransom for the data, then face a second payment to delete the exfiltrated copy from backups or another location the victim failed to secure. This is the same double-dip approach observed across the SLSH ecosystem, and it is what makes the group’s DLS status flow (Active → Leaking → Leaked) more aggressive than a standard single-extortion model.
Key points
- CoinbaseCartel is a data-theft-only extortion group that exfiltrates data and publishes it on a Tor DLS without encrypting victim systems.
- The group has 190 claimed victims across 17 sectors, with the US leading at 71, followed by UAE (12), Germany (11), UK (10), and France (10).
- Recent victims include Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN/Cenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.
- The group draws from the ShinyHunters, Scattered Spider, and Lapsus$ ecosystem (SLSH collective) and uses infostealer logs (RedLine, Lumma, Vidar) as its primary infection vector.
- CoinbaseCartel has no connection to the legitimate Coinbase cryptocurrency exchange and has advertised a $2M+ budget for zero-day exploits.