Coinbase customer data stolen through paid overseas support staff

Coinbase disclosed on May 14, 2025 that an attacker paid multiple contractors or employees in support roles outside the United States to collect customer data from internal Coinbase systems, then demanded 20 million dollars not to publish it. Coinbase said no passwords or private keys were compromised and that the data was used to impersonate Coinbase and trick customers into sending funds.

Victim

Coinbase

Industry

Crypto and Web3

Country

United States

Intrusion began

Not disclosed

First disclosed

May 14, 2025

Actor

Financially motivated

Initial access

Insider misuse

Identity control that failed

Authorization

MFA

Not applicable (no interactive login)

Abused identity

Human account

Records affected

69,461 (Individuals, per Coinbase's notice to the Maine Attorney General.)

Disclosed cost

Coinbase's Form 8-K of May 14, 2025 preliminarily estimated expenses of about USD 180 million to 400 million for remediation and voluntary customer reimbursements. Left null because it is a range, not a final figure.