CoinTracker Third-party security incident (Mixpanel)
4 comments
I'm beyond pissed about this. Why were they sending PII to mixpanel in the first place? Amateur hour big time.
So true! I made a hacker news account to specifically say this ! Mixpanel is being used as a frontend analytics tool, sharing PIIs with them is so incomprehensible!
https://openai.com/index/mixpanel-incident/
openai is impacted too
openai is impacted too
We’re reaching out to let you know about a security event involving one of CoinTracker’s third-party service providers, Mixpanel. We want to be transparent about what happened, what information was involved, and what we’re doing in response.
To be clear: CoinTracker’s systems were not compromised, and no access was gained to our internal infrastructure. What happened
On November 21, 2025, Mixpanel — a data analytics provider used by CoinTracker and many other software companies — provided details of a security incident that occurred within their environment.
Mixpanel’s security team found that an attacker had gained access to their systems through an SMS phishing attack (”smishing”). Using elevated permissions, the attacker exported certain datasets containing CoinTracker user information. Mixpanel stopped the unauthorized activity and initiated an investigation.
CoinTracker systems were not affected. What information was involved
The data involved is limited to profile data, which includes: Email address Geographic location (derived from IP address: city, region, country) Device metadata (e.g., screen size, Android version, mobile carrier) Limited transaction summaries (e.g., 2022 total transaction count) User preferences or attributes (e.g., “is accountant”)
No CoinTracker account logins or specific transaction/wallet data were exposed. What information was NOT involved
Wallet addresses Recovery phrases Private keys (CoinTracker never collects this data) CoinTracker passwords or login credentials Tax forms Exchange-connected transaction data Bank account or credit card information Social Security numbers or other government-issued IDs
CoinTracker’s systems were not compromised. The breach occurred solely within Mixpanel’s environment. Important safety tips
Be alert for any suspicious or unexpected emails. Avoid clicking on links or downloading attachments from unknown sources. If you use CoinTracker, enable multi-factor authentication (MFA) to further protect your account. What we’re doing
We have stopped sending email addresses to Mixpanel and are auditing all tools that handle user data. We’ve also opted into Mixpanel’s third-party review and monitoring process to confirm what was accessed and ensure it does not appear on the dark web.
Protecting your data is our priority. If you have questions or concerns, please don’t hesitate to reach out to our team at [email protected]
The CoinTracker Team