GitHub Gaffe: How a Leaked Token Triggered a Tech Tangle at Coinbase
Coinbase’s supply chain attack was traced back to a compromised personal access token (PAT) linked to the SpotBugs project. By exploiting GitHub Actions, attackers infiltrated repositories, culminating in a three-month wait to target high-profile users like Coinbase. The attackers’ patience finally unraveled when they accidentally exposed their secrets in the logs.
Hot Take:
Who knew that a harmless “SpotBugs” could lead to such a big “BuzzKill” for Coinbase? It’s like a digital whodunit where the clueless gardener leaves the back gate open, and the entire zoo breaks in. And remember, folks, always keep your tokens safe, or they might just end up at a nefarious barbecue in the cyber jungle!
Key Points:
- A personal access token (PAT) from SpotBugs was stolen, leading to a widespread supply chain attack.
- The attack notably targeted GitHub Actions used by Coinbase and others.
- Attackers used a compromised GitHub Actions workflow to infiltrate multiple repositories.
- The breach involved a clever use of GitHub’s “pull_request_target” trigger, leading to a poisoned pipeline execution attack.
- The saga began in November 2024, with an attack on Coinbase occurring in March 2025.
Already a member? Log in here