Coinbase Says Overseas Support Staffers Bribed to Hand Over Data of Nearly 70K Customers

The crypto giant confirmed 69461 users would be receiving direct communications from the company about the attack in a notification filed with Maine's Attorney General on Tuesday.

Coinbase has begun notifying 69,461 customers that their personal data was stolen in a December 26, 2024 breach, according to a notification filed with Maine's Attorney General on Tuesday.

The crypto giant previously disclosed the attack in a May 15 Form 8-K filing with the Securities and Exchange Commission (SEC), estimating the cost of remediation to be between $180 million and $400 million.

The company also stated that the criminals attempted to extort Coinbase for $20 million.

The filing with Maine's AG, which Coinbase is required to make as part of a state law enacted in 2023, provides an update on the actions taken since the initial announcement.

This includes setting up a $20 million bounty for information that could lead to the attackers’ arrest and conviction, as well as pursuing all avenues available to the company to bring those responsible to justice.

Coinbase CEO Brian Armstrong also released a video message to customers on social media, in which he apologized for the impact on them and highlighted the company’s efforts to mitigate the incident.

The filing confirms that the support staff involved in facilitating the data theft have all been fired by Coinbase, and their home country is not yet known.

However, active job boards show some support roles for the massive US cryptocurrency exchange are based in the UK, Ireland, India, the Philippines, and Japan.

The expected cost of remediating the attack stands between $180 million and $400 million, Coinbase said in its SEC filing, although the full extent of the damage is still being investigated.

Coinbase is also aware that some customers were successfully socially engineered by the attackers using the data stolen via the support staff.

To help mitigate this, customers who haven't yet been targeted are advised to remain vigilant against potential further criminal activity and targeting, as well as upping the security of their accounts.

This includes implementing strong 2FA (hardware keys are the preferred choice here) and Withdrawal Allow Listing – a setting that allows withdrawals only from wallets explicitly trusted by the user.

Affected customers are also being offered one year of identity protection and credit monitoring services through IDX, which is standard practice following such events. Instructions on how to claim this are included in the letters Coinbase sent to users.