Coinbase Cartel

Coinbase Cartel is a cyber-extortion group, also referenced as STORM-2981, that emerged around September 2025. Reporting in the provided content consistently describes it as a data-exfiltration-only or data-theft-focused extortion actor that rejects or deemphasizes the traditional ransomware model and typically leaves victim systems available rather than deploying encryptors. The group uses dedicated leak-site pressure and staged disclosure, with victim statuses such as "Active," "Leaking," and "Leaked," and has claimed in some cases to hold multi-terabyte datasets. The content states the group has claimed more than 60 victims, and other reporting in the same content says more than 100 victims. Coinbase Cartel has targeted organizations in multiple regions, including South Korea, the United States, and Slovenia, and is described as having a history of targeting technology companies and publishing stolen code on data leak sites. A documented example in the provided content is the May 2026 Grafana Labs incident, where Coinbase Cartel claimed responsibility after attackers used a compromised GitHub token to access Grafana’s GitHub environment and source code repositories, then attempted to extort the company by threatening publication of the stolen code. The content also notes researcher reporting linking Coinbase Cartel to the broader ecosystem around ShinyHunters, Scattered Spider, and Lapsus$, though no firm attribution beyond that linkage is stated.