Coinbase Targeted in $20 Million Extortion Plot Tied to Insider Data Leak

Cryptocurrency exchange Coinbase said it was the target of a $20 million extortion attempt after cybercriminals recruited overseas customer service contractors to leak user data, in what the company described as a coordinated insider threat. In a blog post on Wednesday, Coinbase disclosed that a small group of customer support agents, hired through third-party vendors, had been bribed by external actors to access internal systems. The breach affected less than 1% of the platform’s monthly transacting users, though no passwords, private keys, funds, or Coinbase Prime accounts were compromised, the company said. The attackers later demanded $20 million in Bitcoin in exchange for not publishing stolen user data. Coinbase refused to pay the ransom and has instead offered a $20 million bounty for information leading to the identification and conviction of those responsible. “Following the attack, we’ve tightened internal access controls and are relocating portions of our support operations to reduce exposure,” Coinbase co-founder and CEO Brian Armstrong wrote on X. The leaked data included names, addresses, and government-issued IDs for a subset of users. Coinbase did not specify how many individuals were affected but confirmed that law enforcement has been involved in the investigation. Coinbase also said it would cover losses for users who were tricked into sending funds to phishing schemes. In a filing with the U.S. Securities and Exchange Commission, the company estimated it would incur between $180 million and $400 million in expenses tied to voluntary reimbursements and remediation efforts. The company has been a frequent target of impersonation and phishing attacks. In 2024, it was the most impersonated crypto brand globally, according to email security firm Mailsuite. Onchain researcher ZachXBT estimates Coinbase users lost around $45 million to phishing scams in the first week of May alone. These attacks often involve scammers posing as Coinbase support staff to trick victims into handing over wallet access or transferring funds. In some cases, scammers contacted real customer support agents in overseas offices, offering bribes in exchange for internal access. Coinbase has dealt with similar threats before. In 2022, the company launched a bounty program following a separate extortion attempt involving a different group of cybercriminals. The exchange is now expanding its bounty offering to include rewards for tips that help authorities locate and prosecute those behind this latest insider-assisted breach.