Cryptocurrency exchange Coinbase disclosed a significant security breach on May 15, 2025, revealing that cybercriminals successfully bribed overseas customer support agents to steal sensitive customer data affecting less than 1% of the platform’s monthly transacting users.
The incident represents a sophisticated insider threat operation designed to facilitate social engineering attacks against Coinbase customers.
The attack involved criminals targeting Coinbase’s overseas customer support operations through cash incentives, convincing a small group of rogue agents to copy sensitive data from internal customer support tools.
The perpetrators obtained a comprehensive range of customer information including names, addresses, phone numbers, email addresses, masked Social Security numbers (last four digits only), masked bank account numbers with some identifiers, government-issued ID images such as driver’s licenses and passports, account balance snapshots, transaction histories, and limited corporate documentation accessible to support staff.
Critically, the attackers did not gain access to login credentials, two-factor authentication codes, private keys, customer funds, Coinbase Prime accounts, or any hot or cold wallet systems.
The stolen data was intended to create a comprehensive customer contact list that criminals could use to impersonate Coinbase representatives in social engineering schemes, ultimately tricking victims into voluntarily transferring their cryptocurrency assets to attacker-controlled wallets.
Coinbase Customer Data
Following the data theft, the criminal organization demanded $20 million from Coinbase to prevent the misuse of stolen customer information.
The company categorically rejected this extortion attempt and instead announced the establishment of a $20 million reward fund to incentivize information leading to the arrest and conviction of those responsible for the attack.
Coinbase is actively cooperating with both U.S. and international law enforcement agencies to pursue criminal charges against the perpetrators.
The company has implemented immediate remediation measures including the termination of involved support agents and their referral to law enforcement authorities.
Coinbase is also working with industry partners to trace stolen funds by tagging attacker addresses, enabling authorities to track and potentially recover compromised assets.
Enhanced Security Measures
In response to the breach, Coinbase has implemented comprehensive security enhancements across multiple operational areas.
The company committed to reimbursing customers who were successfully defrauded through social engineering attacks related to this incident, following verification procedures to confirm the connection between losses and the data breach.
Operational improvements include opening a new customer support hub within the United States and implementing stronger security controls and monitoring systems across all global locations.
The platform has flagged affected accounts to require additional identity verification for large withdrawals and incorporated mandatory scam-awareness prompts during high-risk transactions, which may result in processing delays for some users.
Coinbase emphasized that customers should remain vigilant against imposter communications, as legitimate company representatives will never request passwords, two-factor authentication codes, or instruct users to transfer assets to specific addresses or “safe” wallets.
The company recommends enabling withdrawal allow-listing, using hardware-based two-factor authentication, and immediately locking accounts when suspicious activity is detected.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
.webp?fit=1068,580&ssl=1&description=Cryptocurrency exchange Coinbase disclosed a significant security breach, revealing that cybercriminals successfully bribed overseas customer support agents.){kind=link}