Coinbase, one of the world's leading cryptocurrency exchanges, is grappling with the fallout from a major cybersecurity incident that could cost the company between $180 million and $400 million. The breach, which involved the bribery of overseas customer support agents, has exposed sensitive customer data and led to a $20 million extortion attempt.
On May 11, 2025, Coinbase received an email from an "unknown threat actor" claiming to possess information about certain customer accounts and internal documents. Investigations revealed that cybercriminals had bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks. These insiders abused their access to customer support systems to steal the account data for a small subset of customers, reportedly less than 1% of Coinbase's monthly transacting users which translates to roughly 69,461 individuals.
The compromised data includes a combination of personal identifiers such as names, addresses, phone numbers, email addresses, dates of birth, the last four digits of social security numbers, masked bank account numbers and some bank account identifiers. Depending on the affected customer, the stolen information can also contain images of government identification information (e.g., driver's license number, passport number, national identity card number) and account information (including transaction history, balance, transfers, account opening date).
Importantly, Coinbase has stated that no passwords, private keys, or funds were exposed, and Coinbase Prime accounts remain untouched. However, the leaked data is sufficient for sophisticated social engineering attacks, where criminals impersonate Coinbase representatives to trick users into transferring their crypto assets.
The attackers demanded a $20 million ransom in Bitcoin, threatening to release the stolen data publicly if their demands were not met. Coinbase CEO Brian Armstrong publicly refused to pay the ransom, stating, "We will not fund criminal activity." Instead, Coinbase has offered a $20 million reward for information leading to the arrest and conviction of those responsible for the attack.
Coinbase is taking several steps to address the breach and prevent future incidents. The company has fired the involved personnel and referred them to law enforcement. They are also investing in increased insider-threat detection and hardening their systems around customer support.
Furthermore, Coinbase is establishing a new support hub in the U.S. and adding stronger security controls and monitoring across all locations. Flagged accounts now require additional ID checks on large withdrawals and include mandatory scam-awareness prompts. The company is also working closely with law enforcement to pursue the harshest penalties possible against the criminals.
The financial impact of the breach is expected to be significant, with preliminary estimates ranging from $180 million to $400 million. This figure includes remediation costs and voluntary customer reimbursements. Coinbase has pledged to reimburse customers who were tricked into sending funds to the attackers due to social engineering attacks.
The breach has raised concerns about the security of cryptocurrency exchanges and the potential for insider threats. Experts recommend that crypto exchanges adopt a "layered defense strategy" that includes privileged access management, zero trust architecture, multifactor authentication across internal systems, and continuous monitoring with behavioral analytics.
The U.S. Department of Justice has launched an investigation into the cyberattack. Justice Department investigators, including those from the department's criminal division in Washington, are now examining the circumstances surrounding the breach.
The Coinbase data breach serves as a reminder of the importance of cybersecurity in the cryptocurrency industry. As the industry grows and becomes more mainstream, it is increasingly targeted by cybercriminals. Cryptocurrency exchanges must invest in robust security measures to protect customer data and prevent future attacks.
