Coinbase Promises $20M Bounty to Capture Bitcoin BTC/USD Ransomware Attackers

Coinbase on Thursday disclosed a material cybersecurity incident involving insider abuse and data theft, leading to a $20 million Bitcoin BTC/USD ransom demand

Coinbase (NASDAQ:COIN) on Thursday disclosed a material cybersecurity incident involving insider abuse and data theft, leading to a $20 million Bitcoin (BTC/USD) ransom demand from a threat actor, which the company has refused to pay.

Instead, Coinbase is placing a $20 million bounty for information leading to the arrest and conviction of the perpetrators.

What Happened: Attackers were able to bribe overseas support contractors to exfiltrate internal documentation and personal user data, including names, contact details, masked bank and S.S.N data and government I.D.s, the company disclosed in a Form 8-K filing with the U.S. Securities and Exchange Commission on Monday.

The breach affected less than 1% of monthly transacting users, according to the company.

"We are not going to pay your ransom … Instead, we're putting out a $20 million award for any information leading to the arrest and conviction of these attackers," Coinbase CEO Brian Armstrong said in a blog post.

The CEO said the attackers went after weak links by targeting third-party customer support agents in foreign countries. While no passwords, private keys or funds were accessed, Armstrong noted the real threat of social engineering attempts using the leaked personal data.

"They were able to find a few bad apples … this is still unacceptable," Armstrong said.

Some of the compromised contractors had previously been flagged and terminated by Coinbase’s security systems.

The company began receiving emails from the threat actor demanding a ransom of 50 Bitcoin (around $20 million) in return for decrypting data and halting further intrusions. The first email was received on May 11, and the company has been working with law enforcement.

The affected customers were notified, and Coinbase will reimburse any user who lost funds as a direct result of the breach, Armstrong confirmed.

Additional measures include relocating parts of the customer support operation to the U.S. and tightening internal access controls.

The company has not experienced any material operational disruption but said it expects to incur expenses of $180 million to $400 million related to remediation and reimbursements.

See More: Best Cryptocurrency Scanners