Coinbase Exposes Insider Data Breach and Rejects $20 Million Ransom Demand

Highlights:

• Coinbase has refused to pay ransom after support agents leaked customer data.
• The company has launched a reward fund to catch the criminals who tried to extort the company.
• Coinbase has strengthened its security and moved support teams to protect users from future scams.

Coinbase disclosed that criminals got unauthorized access to their tools by bribing their outside customer service team. They illegally accessed customer files and obtained some helpful information. Coinbase said that fewer than 1% of those who transact with them every month were affected. The firm said that users’ login credentials, wallet keys, and funds remained safe.

Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on <1% of Coinbase MTUs. No passwords, private keys, or funds were exposed. Prime accounts are untouched. We will reimburse impacted customers. More here: https://t.co/SidVn59JCV

— Coinbase 🛡️ (@coinbase) May 15, 2025

The hackers were able to steal names, phone numbers, home addresses, and email addresses. Data collected included hidden masked Social Security numbers, masked bank accounts, and details regarding banks. Apart from credit card details, the hackers gained access to driver’s licenses and passports. They managed to take photographs of the money in customers’ accounts, their transactions, and their discussions with the support staff.

The criminals requested that Coinbase give them $20 million, warning that they would release the stolen data unless the money was paid. Brian Armstrong said in his reply that he would not give in to the ransom demand. Instead, he set up a $20 million reward for any information that would help find and arrest those involved. Armstrong warned that the exposed information would give attackers the ability to pretend to be Coinbase support staff in order to defraud users.

https://t.co/evpIBMFvRW pic.twitter.com/f6UPdkL5R0

— Brian Armstrong (@brian_armstrong) May 15, 2025

Coinbase Strengthens Security After Data Breach

The company dismissed the involved personnel and gave the case to the police. He pointed out that the company had terminated them and informed the authorities in the USA and abroad. Coinbase said it is moving some customer support tasks to other areas. They are also looking to set up a support center in the United States.

Coinbase is working towards increased security across all of its global operations. The company bought new tools to find threats within the company and improved its automated responses. Moreover, Coinbase began routinely evaluating risks to keep its network secure. They are doing this work in order to avoid facing similar problems again.

Coinbase is planning to compensate the victims who lost funds from phishing scams resulting from the earlier security incident. It is estimated that the company may have to pay between $180 million and $400 million to reimburse customers. Coinbase reached out to users and will update them if further actions are needed. Armstrong assured that the company would file lawsuits against everyone who took part in the extortion.

Company Urges Users to Remain Cautious

Coinbase put out a notice to try to prevent more fraud from happening. The company has made a point that it does not request for users to share their passwords, 2FA codes, seed phrases, or transfer coins. Coinbase encouraged users to never hand out their personal information to anyone claiming to work for them.

Coinbase noted that it does not instruct users to send their cryptocurrency to a different wallet. The company is teaming up with officials to capture the attackers and ensure more protection. The hack comes days after criminals targeted ZKsync in a phishing scheme.