Dark Web News Analysis
A threat actor on a known cybercrime forum is advertising the sale of a database allegedly belonging to CoinMarketCap (coinmarketcap.com), the world’s most-referenced price-tracking website for cryptoassets. The dataset reportedly contains 1,000,000 lines of data, including email addresses and passwords, and is being sold for $1,000.
Brinztech Analysis:
- The Listing: The seller claims the data originates from the USA and includes valid credentials. The contact is facilitated via Telegram.
- Credibility Assessment: This listing warrants skepticism regarding a direct system breach.
- Price Anomaly: A fresh, direct hack of CoinMarketCap (owned by Binance) exposing 1 million active passwords would typically command a much higher price than $1,000.
- “Combolist” Probability: It is highly probable that this is a “Combolist”—a collection of email/password pairs aggregated from other recent breaches (infostealers or other sites) that have been “checked” against CoinMarketCap to verify they are registered users. This is a common tactic to re-monetize old data.
- Historical Context: CoinMarketCap faced a similar incident in October 2021, where 3.1 million email addresses were leaked. At that time, the company confirmed the data was correlated with their user base but denied a server breach, attributing it to scraping or combolists. The presence of passwords in this new 2025 claim makes it more dangerous than the 2021 email-only leak.
Key Cybersecurity Insights
Regardless of the source (direct breach vs. combolist), the availability of this list presents a critical threat:
- Credential Stuffing & Account Takeover: The exposure of email and password combinations creates an immediate risk of Account Takeover (ATO). Attackers will use automated tools to test these credentials not just on CoinMarketCap, but on exchanges (Binance, Coinbase) and email providers, betting on password reuse.
- Targeted Phishing: A list of 1 million verified crypto-interested users (specifically in the USA) is a “goldmine” for spear-phishing. Attackers can send fake “Security Alert” or “Airdrop” emails purporting to be from CoinMarketCap to steal wallet private keys or install malware.
- Data Authenticity: The “alleged” status necessitates immediate verification. However, for users, the existence of the list is the threat. If your email is in it, you are a target.
Mitigation Strategies
In response to this claim, CoinMarketCap users must take immediate action:
- Password Reset Enforcement: Change your CoinMarketCap password immediately. Crucially, if you use that same password on any other site (especially crypto exchanges or email), change those too.
- Enable Strong 2FA: Enable Two-Factor Authentication (2FA) on your CoinMarketCap account. Use an authenticator app or hardware key (YubiKey), as SMS 2FA is vulnerable to SIM swapping.
- Credential Monitoring: Use services like Have I Been Pwned to check if your email has appeared in recent breaches.
- Phishing Awareness: Be extremely skeptical of emails claiming to be from CoinMarketCap, especially those asking for login details or offering “portfolio tracking” updates.
Secure Your Business with Brinztech — Global Cybersecurity Solutions Brinztech protects organizations worldwide from evolving cyber threats. Whether you’re a startup or a global enterprise, our expert solutions keep your digital assets safe and your operations running smoothly.
Questions or Feedback? For expert advice, use our ‘Ask an Analyst’ feature. Brinztech does not warrant the validity of external claims. For general inquiries or to report this post, please email us: contact@brinztech.com
Like this:
Like Loading...
Post comments (0)