Coinbase: Scammers bribed insiders to steal customer data and demand $20 million ransom

A Breach from Within

Coinbase, the largest U.S.-based cryptocurrency exchange, disclosed a significant data breach on May 15, 2025. Cybercriminals bribed overseas customer support agents to access sensitive user information. The breach affected up to 97,000 users, less than 1% of the company’s monthly active users. Although no customer funds were accessed, stolen information included names, contact details, masked Social Security and bank numbers, government ID images, and account activity data.

The Ransom Demand

On May 11, Coinbase received an email from the attackers demanding a $20 million ransom to prevent the public release of the stolen data. CEO Brian Armstrong refused to pay and instead offered a $20 million reward for information leading to the attackers’ arrest.

Financial Impact and Response

Coinbase estimates the incident could cost between $180 million and $400 million due to technical remediation and customer reimbursements. The company has terminated the employees involved, pledged cooperation with law enforcement, and created a $20 million reward fund to aid in the attackers’ apprehension. Following the announcement, Coinbase’s stock dropped by 4.5%, though it remains up 1.3% for the year and is set to join the S&P 500 index.

Strengthening Security Measures

In response to the breach, Coinbase plans to open a new customer support center in the U.S. and adopt additional security measures. The company is investing in anti-fraud technologies to mitigate the possibility that any of the stolen data could be used to defraud customers further. It pledged to reimburse those who had already been scammed.

What Users Should Do

Coinbase advises customers to be cautious of scammers impersonating Coinbase employees and attempting to trick them into transferring funds or asking for sensitive information. The company recommends enabling two-factor authentication and turning on withdrawal allow-listing to ensure secure transfers.

As Coinbase navigates the aftermath of this breach, the incident serves as a reminder of the importance of security measures and the potential risks associated with insider threats.

Especially in a founder community like this, it’s important to stay alert for scams. For example, if someone asks you to try out their product and you need to create an account, always use a unique password. It could be a scammer attempting to steal your credentials.