Coinbase Dodges Major Cyber Bullet in GitHub Supply Chain Breach

At a glance

• Coinbase was the first target of a supply chain attack carried out through GitHub Actions.
• The attack did not reach customer funds.
• Attackers compromised widely used GitHub Actions, a newer kind of supply chain threat.
• Coinbase fixed the exposure after a security report, which limited the damage.
• Researchers urge tighter controls on the third-party actions that run inside build pipelines.

A targeted attack on Coinbase’s code

Coinbase is the gateway to crypto for millions of people, so its code is a valuable target. In March 2025, attackers went after it through GitHub, where the company hosts open-source projects. Palo Alto Networks’ Unit 42 later found that the campaign behind the widespread tj-actions/changed-files compromise had started as a targeted attempt on Coinbase.

How the attack worked

GitHub Actions lets developers automate testing and builds with reusable workflow steps written by others. Attackers compromised popular actions, including tj-actions/changed-files and reviewdog/action-setup, so that any project running them would leak secrets. The first target was Coinbase’s open-source agentkit project.

Coinbase’s workflow ran the malicious action on March 14, 2025, and exposed a GitHub token with write permission. According to Unit 42, the attacker could not use Coinbase secrets or publish packages, and Coinbase fixed the workflow after a security report.

How the exposure was contained

The attackers then widened the campaign to the tj-actions/changed-files action used by thousands of repositories. Coinbase said no customer funds or data were affected. Nothing was stolen.

GitHub and the maintainers removed the malicious code from the affected actions and restored clean versions. Projects that had run the compromised versions were told to rotate any exposed secrets.

Lessons for build pipelines

Security researchers say the incident shows how much trust development teams place in third-party code that runs inside their build systems. A single compromised action can expose credentials across thousands of projects.

The fixes are well known. Pin actions to a full commit SHA instead of a version tag, give workflow tokens the least permission they need and audit dependencies regularly.

Checking your own repositories

The incident pushed many companies to review their CI/CD policies. The attack shape keeps shifting. Even well-defended companies are exposed when a tool they did not write is compromised.

Teams that use GitHub Actions should search their workflows for tj-actions/changed-files and reviewdog actions, check logs from mid-March 2025 for leaked secrets and rotate anything printed to a log. Do it today.

Hardening CI/CD

The attempt on Coinbase is a reminder that build pipelines are part of the attack surface. Restrict which third-party actions can run in your organization, require review for workflow changes and keep secrets out of jobs that build pull requests from forks. Those controls would have blunted this attack.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.