Coinbase fights $20M extortion plot after thieves steal user data in massive breach

By Matt Brienen

Published: 2025-05-15T17:39:40+00:00

In a bold move against cybercriminals, Coinbase, the largest cryptocurrency exchange in the United States, revealed on Thursday that thieves stole sensitive customer data and attempted to extort the company for $20 million. The breach, detailed in a Securities and Exchange Commission (SEC) filing, involved hackers obtaining names, addresses, government identification, and partial Social Security numbers from an undisclosed number of users. Instead of yielding to the criminals’ demands, Coinbase announced a $20 million bounty for information leading to their arrest. This incident marks a significant challenge for the exchange, which has largely avoided major cyber incidents until now.

The breach has raised alarm in the cryptocurrency industry, where exchanges are prime targets due to the decentralized nature of digital currencies like Bitcoin. Coinbase’s response, including reimbursements for affected customers and a proactive push for justice, underscores the growing threat of cybercrime in the sector. The company estimates losses from remediation and customer reimbursements could range from $180 million to $400 million.

The hackers gained access to user data by paying overseas contractors and support workers, exposing vulnerabilities in third-party relationships. Coinbase’s swift action, including notifying affected customers and enhancing security measures, aims to restore trust amid rising concerns about data privacy.

Stolen data included names, addresses, and partial Social Security numbers. Hackers used stolen information to impersonate customer support and trick users. Coinbase’s $20 million bounty targets the identification and arrest of the culprits. Extortion attempt unfolds Coinbase received an extortion email on Sunday, demanding $20 million in exchange for not leaking or selling the stolen customer data. The company’s SEC filing, submitted Wednesday evening, outlined the scope of the breach, which included transaction histories and contact details. Rather than complying, Coinbase opted to fight back, offering a $20 million reward to track down the perpetrators.

The decision to publicize the bounty reflects Coinbase’s aggressive stance against cybercriminals. CEO Brian Armstrong, in a video posted to X, emphasized the company’s commitment to prosecuting those responsible. He noted that the breach affected fewer than 1% of Coinbase’s monthly active users, though the exact number remains undisclosed.

This incident highlights the sophistication of modern cybercrime, with criminals exploiting insider access to sensitive systems. Coinbase’s refusal to pay the ransom aligns with broader industry trends, where companies increasingly opt for transparency and legal action over capitulating to extortion demands.

The extortion email arrived on Sunday, threatening to leak stolen data. Coinbase’s bounty matches the $20 million demanded by the hackers. Fewer than 1% of monthly active users were affected, per Armstrong. Customer deception tactics Using the stolen data, criminals posed as Coinbase customer support to deceive users into transferring funds. These scams, known as social engineering attacks, tricked some customers into revealing login credentials or moving assets to fraudulent accounts. Armstrong confirmed that affected customers would be fully reimbursed, though the total amount stolen remains unclear.

In an email sent to impacted users on Thursday morning, Coinbase clarified that it would never directly request login information or instruct customers to transfer assets. The company urged users to remain vigilant against phishing attempts and to verify communications through official channels. This proactive communication aims to mitigate further losses and rebuild customer confidence.

The incident underscores the vulnerability of cryptocurrency users to targeted scams. With access to personal details like names and transaction histories, hackers can craft convincing impersonations, making it critical for exchanges to educate users on security best practices.