CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CoinbaseCartel

actor · actor:coinbasecartel

Data-theft extortion group active since September 2025 that lists victims on its leak site without encrypting files; security firms link it to ShinyHunters, Scattered Spider and Lapsus$, which ShinyHunters denies (SecurityWeek; BleepingComputer, 2026-05-18).

Aliases: Coinbase Cartel

Coverage
1
first 2026-05-19 → last 2026-10-21
Latest activity
2026-05-19
Grafana Labs: a GitHub workflow token missed after the TanStack npm compromise let attackers take its codebase
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
5
4 hosts

Defender insights

What each entry about CoinbaseCartel tells a defender to do, newest first.

2026-05-19NOTABLEGrafana Labs: a GitHub workflow token missed after the TanStack npm compromise let attackers take its codebase

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

  1. 2026-05-19Grafana Labs confirms GitHub breach claimed by CoinbaseCartel: a workflow token missed after the TanStack npm compromise let attackers download its code and internal repositories
    active-threatsGrafana Labs: a GitHub workflow token missed after the TanStack npm compromise let attackers take its codebase

Hunting pivots

Tags
data-breachorganized-crimesupply-chain
ATT&CK techniques (4 across 4 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Dependencies and Development Tools
  • Credential AccessSteal Application Access Token
  • CollectionData from Information Repositories: Code Repositories
  • ImpactFinancial Theft

Initial Access TA0001

T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools×1

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.

Evidence: 2026-05-19/grafana-labs-coinbasecartel-breach-victim-confirms-source-co · ATT&CK page ↗

Credential Access TA0006

T1528Steal Application Access Token×1

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-05-19/grafana-labs-coinbasecartel-breach-victim-confirms-source-co · ATT&CK page ↗

Collection TA0009

T1213.003Data from Information Repositories: Code Repositories×1

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Evidence: 2026-05-19/grafana-labs-coinbasecartel-breach-victim-confirms-source-co · ATT&CK page ↗

Impact TA0040

T1657Financial Theft×1

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-05-19/grafana-labs-coinbasecartel-breach-victim-confirms-source-co · ATT&CK page ↗

Entries about CoinbaseCartel (1)

2026-05-19 · view entry permalink →

NOTABLEupdatedNATOB2

Grafana Labs confirms GitHub breach claimed by CoinbaseCartel: a workflow token missed after the TanStack npm compromise let attackers download its code and internal repositories

Grafana Labs said in posts on X that an unauthorized party had obtained a token granting access to its GitHub environment and downloaded its codebase, that no customer data or personal information was accessed and customer systems were unaffected, and that it would not pay the attacker's extortion demand, following FBI guidance (The Hacker News, 2026-05-17; BleepingComputer, 2026-05-18). SecurityWeek dates the confirmation to Sunday 2026-05-17, two days after the group CoinbaseCartel listed Grafana on its leak site on 2026-05-15 (SecurityWeek, 2026-05-18). In its update of 2026-05-19, Grafana said the incident originated from the TanStack npm supply-chain attack via the Mini Shai-Hulud campaign, that it detected the malicious activity on 2026-05-11 and rotated a significant number of GitHub workflow tokens, but that a missed token, from a workflow it had first deemed not impacted, gave the attackers access to its repositories (Grafana Labs, 2026-05-19); The Hacker News attributes the TanStack attack to TeamPCP (The Hacker News, 2026-05-20). The download covered public and private source code and internal repositories some teams use for operational information, including business contact names and email addresses, but not production systems or the Grafana Cloud platform; the ransom demand from an unnamed actor arrived on 2026-05-16, and Grafana has since rotated automation tokens, implemented enhanced monitoring and audited all commits since the May 11 incident (Grafana Labs, 2026-05-19).

CoinbaseCartel, active since September 2025, steals data and extorts victims without encrypting files; SecurityWeek counts 105 victims on its site, while The Hacker News, citing Halcyon and FortiGuard Labs, puts the total at 170 (SecurityWeek, 2026-05-18; The Hacker News, 2026-05-17). Security firms link the group to ShinyHunters, Scattered Spider and Lapsus$ (SecurityWeek, 2026-05-18), but ShinyHunters told BleepingComputer that CoinbaseCartel is not linked to it (BleepingComputer, 2026-05-18). Grafana's paying customers include governments, banks and infrastructure operators, and more than 7,000 organizations use the product (BleepingComputer, 2026-05-18).

Grafana confirmed suffering a data breach on Sunday, two days after a cybercrime group listed the company on its leak website.

SecurityWeek 2026-05-18

We performed analysis and quickly rotated a significant number of GitHub workflow tokens, but a missed token led to the attackers gaining access to our GitHub repositories,

This includes business contact names and email addresses that would be exchanged in a professional relationship context, not information pulled from or processed through the use of production systems or the Grafana Cloud platform.

Grafana Labs (via The Hacker News)

After publishing this article, the ShinyHunters extortion gang told BleepingComputer that the CoinbaseCartel is not linked to their group or ransomware operation.

BleepingComputer 2026-05-18
Correctionrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationentitiesevent_dateevidenceheadlineregionssectorssourcessourcing_notesummarytechniquestitle

No source on the May 2026 breach describes a pull_request_target or Pwn-Request mechanism: Grafana says the incident originated from the TanStack npm supply-chain attack via the Mini Shai-Hulud campaign, detected on 2026-05-11, and that a GitHub workflow token missed during the rotation that followed gave the attackers access (Grafana Labs, 2026-05-19), an attack The Hacker News attributes to TeamPCP (The Hacker News, 2026-05-20). The theft was not limited to source code: the downloaded content also included internal repositories holding operational information and business contact names and email addresses, while production systems and the Grafana Cloud platform were not involved (The Hacker News, 2026-05-20). The link between CoinbaseCartel and ShinyHunters is contested, since ShinyHunters told BleepingComputer the group is not linked to it (BleepingComputer, 2026-05-18), and SecurityWeek counts 105 victims on CoinbaseCartel's site rather than about 170 (SecurityWeek, 2026-05-18). No source places Grafana in Swiss or EU public-sector monitoring estates or calls for watching unofficial Grafana plugins; Grafana says it audited all commits for malicious activity (The Hacker News, 2026-05-20).

incident19 May 05:00Zmulti-sourceOpen finding →
Sources: SecurityWeek · BleepingComputer · The Hacker News · Grafana Labs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • thehackernews.com2 (40%)
  • bleepingcomputer.com1 (20%)
  • grafana.com1 (20%)
  • securityweek.com1 (20%)
All cited sources (5)