The Coinbase_API_Keys Leak: 2,261 Logins That Could Drain a Wallet

HEROIC analysts found a combolist named "Coinbase_API_Keys" uploaded to Telegram on March 19, 2026, containing 2,261 records. Despite the name, the actual data inside is a standard combination of email addresses, plaintext passwords, and login URLs. HEROIC found no evidence that real Coinbase API keys were included, the filename appears to be the uploader's marketing for the file rather than a description of its contents. Why This Is Dangerous: Regardless of what the file is named, plaintext email and password pairs tied to a URL are enough for an attacker to attempt to log directly into accounts, including cryptocurrency exchange accounts if any of these credentials were reused on Coinbase or similar platforms. What Was Exposed: - Email addresses - Plaintext passwords - URLs indicating which sites the logins target Why This Matters: Crypto-themed combolists are popular precisely because a successful login can mean direct, irreversible financial loss. If someone reused a password from this file on an exchange account, an attacker attempting credential stuffing could drain funds before the victim even notices. How a Combolist Like This Works: Sellers and uploaders often give combolists eye-catching, high-value names, like referencing API keys or a well-known exchange, to attract buyers or downloads, even when the file itself contains ordinary stolen logins rather than the specific asset advertised. It's a marketing tactic as much as a technical description. Check If You Are Affected: Don't take the filename at face value, check for yourself. Search your email against this leak and HEROIC's database of more than 400 billion exposed records using HEROIC's free breach scanner, and update any reused passwords right away.