Coinbase Confirms Data Breach by Rogue Employees, Offers $20M Bounty

In a cyberattack that has sent shockwaves through the cryptocurrency industry, Coinbase, one of the world's largest crypto exchanges, has confirmed a data breach

Coinbase (NASDAQ:COIN) has disclosed a data breach affecting less than 1% of its 9.7 million monthly active users (MAUs), impacting less than 0.1% of its total user accounts. The breach was the result of an insider threat, with several overseas support contractors being bribed by cybercriminals to pull personal data from internal systems.

This information was used to launch a social engineering campaign, where the attackers impersonated Coinbase to defraud users and ultimately demanded a $20 million ransom to keep the stolen data private. However, Coinbase refused to pay up and is instead offering a $20 million bounty for information leading to the arrest and conviction of those involved.

What Happened

According to a regulatory filing and a statement by Coinbase, several support contractors in countries outside the U.S. were targeted by cybercriminals. The attackers used advanced AI and deepfake technologies to create highly convincing phishing messages and video calls, luring the contractors into divulging small amounts of personal data from internal systems.

This data was used to launch a social engineering campaign on a smaller subset of Coinbase users. The attackers contacted these users via email, phone, and text messages, impersonating Coinbase in attempts to deceive users into transferring their crypto to attackers’ wallets.

Crucially, no funds, passwords, private keys, or 2FA credentials were compromised, and Coinbase Prime users were not affected. However, the breach triggers alarm due to the nature of the stolen data and the method of infiltration.

Coinbase's Response

Coinbase is taking several steps to remediate the breach and protect its users. The company has notified all affected users and is offering to reimburse any customer who was tricked by the scammers into sending them any funds.

Coinbase is also placing stricter withdrawal protocols on the affected accounts, adding new layers of ID verification and scam-awareness prompts before any attempt to withdraw funds.

In the long term, Coinbase is establishing a new U.S.-based customer support hub and rolling out an advanced insider-threat detection system across all of its global support centers. The rogue employees have been terminated and referred for prosecution, and the company is working closely with law enforcement agencies in multiple countries to identify and apprehend the criminals.

“Trust is foundational to crypto adoption,” the company said. “We’re sorry for the concern this incident caused and remain committed to protecting our users at every step.”

Expert's Take

This incident highlights the growing sophistication of cybercriminals, especially those exploiting human fallibility rather than technical flaws. As new technologies like AI and deepfakes become more accessible, they are being used by these actors to bypass traditional fraud prevention measures.

“We are at an inflection point in digital trust,” said Nick Jones, CEO of crypto platform Zumo. “As our nascent industry grows rapidly, it draws the eye of bad actors who are now harnessing AI tools to an unprecedented degree.”

Jones noted the timing of the breach is especially painful for Coinbase, which recently acquired Deribit in one of the largest digital market deals and was added to the S&P 500—milestones that mark it as a global industry leader. He added that institutions are also investing heavily in blockchain and Web3 technologies.

However, Jones pointed out the EU is rolling out new legislation like DORA to ensure the resilience of the financial services supply chain and enforce stricter standards of data hygiene. “This attack makes a compelling case for similar legislation and best practices to be adopted across crypto platforms.”