Coinbase data breach exposes high-value crypto holders to cyber criminals

05/28/2025 / By Laura Harris

Cybercriminals bribed overseas Coinbase support agents (based in India) to leak customer data, including names, addresses and masked bank details. No passwords, private keys or funds were stolen, but attackers used the data for social engineering scams.
Prominent investor Michael Arrington criticized Coinbase on X, warning that leaked home addresses and account balances could endanger lives. He condemned cost-cutting on security and called for executive accountability.
Coinbase CEO Brian Armstrong refused to pay the ransom and instead offered a $20 million reward for information leading to the arrest of the attackers, mirroring the strategy from the film Ransom (1996).
Compromised support agents were fired and Coinbase is working with authorities to track the hackers. The company pledged to reimburse affected customers who lost funds due to scams.
The incident highlights vulnerabilities in digital systems, especially when human factors (e.g., underpaid employees) are exploited. Coinbase faces reputational damage and financial costs despite assurances of enhanced safeguards.

Cryptocurrency exchange Coinbase has confirmed a major data breach exposing sensitive customer information to cyber criminals.

According to internal reports, the attackers bypassed technical safeguards by bribing underpaid Coinbase customer support employees in overseas outsourcing centers, later confirmed to be based in India, to leak customer information, including names, addresses, masked bank details and ID documents. While no funds, passwords or private keys were compromised and Coinbase Prime accounts remain secure, the attackers used the stolen data to launch targeted social engineering scams.

“Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks. These insiders abused their access to customer support systems to steal the account data for a small subset of customers. No passwords, private keys or funds were exposed and Coinbase Prime accounts are untouched,” Coinbase wrote in an official statement on their blog. (Related: Coinbase faces $400M fallout after insider-led phishing attack exposes customer data.)

Prominent investor Michael Arrington, a longtime Coinbacker, blasted the company on X, formerly known as Twitter.

“I am a long-time investor in and champion of @coinbase. Something that has to be said though, this hack, which includes home addresses and account balances, will lead to people dying. It probably has already. The human cost, denominated in misery, is much larger than the $400m or so they think it will actually cost the company to reimburse people. The consequences to companies who do not adequately protect their customer information should include, without limitation, prison time for executives. Very disappointed in Coinbase right now. Using the cheapest option for customer service has its price. And Coinbase’s customers will bear that cost,” Arrington posted on X.

This aligns with the broader concern that digital systems, no matter how advanced, are never entirely secure, especially when human vulnerabilities are involved.

Coinbase offers $20 million reward for information that leads to arrest and conviction of attackers

In response to the attack, Coinbase CEO Brian Armstrong announced a $20 million reward for information leading to the arrest and conviction of the attackers – a move reminiscent of the 1996 film Ransom.

“We are not going to pay your ransom,” Armstrong said in a video statement released on his official X account. “A few next steps in mind… We’re putting out a $20 million award for any information leading to the arrest and conviction of these attackers.” Coinbase echoed a similar statement on their blog and retweeted this video from Armstrong.

“We will reimburse customers who were tricked into sending funds to the attacker. We’re cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received. Instead, we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack,” Coinbase wrote.

Meanwhile, Coinbase’s Chief Security Officer Philip Martin confirmed that the compromised support agents have been terminated and that the company is working closely with law enforcement.

“The knee-jerk reaction of every single person who heard we were being extorted was ‘hell no!'” Martin said. He added that the hackers threatened to publish the stolen data unless Coinbase paid – a demand the company flatly rejected. Coinbase has tagged the attackers’ wallet addresses and pledged to reimburse any customers who lost funds due to the social engineering scams.

Learn more about the state of the cryptocurrency market at CryptoCult.news.

Watch this episode of the “Health Ranger Report” as Mike Adams, the Health Ranger, tells his viewers that even though crypto may crash, people should still learn how to use it.

This video is from the Health Ranger Report channel on Brighteon.com.