Hackers bribed our staff to access customer data – Coinbase

• Published On: 15 May 2025 at 18:37

Coinbase, a major cryptocurrency exchange, revealed on Thursday that cybercriminals bribed overseas customer support agents to steal sensitive customer information, which was then used in social engineering attacks.

Coinbase estimated that the breach, as detailed in an SEC filing, could cost the company up to $400 million to remediate.

Coinbase discovered the incident on May 11 when it received an email from someone claiming to have obtained customer account information and internal documents, including customer-service and account-management system materials.

The sender demanded payment to prevent public disclosure, but Coinbase refused and is cooperating with law enforcement to investigate.

The stolen data included names, addresses, phone numbers, emails, masked bank account numbers, the last four digits of Social Security numbers, government ID images, and account balances, according to the company. Passwords and private keys were not compromised.

Coinbase's stock fell 4% following the announcement, reflecting investor concerns about the financial and reputational consequences.

The company has not disclosed the number of affected customers, but has emphasised its commitment to resolving the problem and improving security measures.

"Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks," the organisation wrote on its blog. "These insiders abused their access to customer support systems to steal account information from a small number of customers. No passwords, private keys, or funds were exposed, and Coinbase Prime accounts remained unaffected. "We will reimburse customers who were duped into sending money to the attacker."

According to the filing, Coinbase discovered the breach on its own several months ago. The company promptly fired the employees involved, notified the affected customers, and strengthened its fraud detection procedures.

According to the report, the threat actor paid overseas contractors and support employees to obtain the information.

"We're cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received," according to the business's blog. "Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack."

Coinbase, the largest cryptocurrency exchange in the United States, has recently made significant strides, expanding its global footprint and reaching a significant milestone in traditional finance.