Coinbase Hit by $20M Extortion Plot After Data Breach

Crypto News Exploits

Coinbase Hit by $20 Million Extortion Plot After Insider Data Leak

Written by Aaron S.,

Editor-In-Chief

Last Updated: May 16, 2025

Key Takeaways

Coinbase was targeted in a $20 million extortion attempt after attackers bribed overseas support staff;
Coinbase refused the ransom and instead offered a $20 million reward to help catch those behind the scheme;
Less than 1% of users were affected, but refunds and fixes may cost Coinbase up to $400 million.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Coinbase Hit by $20 Million Extortion Plot After Insider Data Leak

BITDEGREE IN YOUR SOCIAL FEED

The cryptocurrency exchange Coinbase $2.11B was recently targeted in a scheme where attackers tried to extort $20 million after gaining access to some internal tools.

According to the company, several overseas support contractors were bribed by outsiders to leak limited customer data.

In a blog post published on May 15, Coinbase explained that the attackers convinced a few support agents to misuse their access and retrieve information from a small number of user accounts.

How to Get Free Crypto? (Explained with Animations)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

No login credentials, private keys, funds, or Prime accounts were exposed. The company said that less than 1% of active monthly users were affected.

After collecting the stolen data, the group demanded $20 million worth of Bitcoin BTC $93,642.95 to keep the breach private. However, Coinbase offered a $20 million reward for information that could help identify and convict the individuals involved.

Coinbase said it plans to refund those users, and estimated that the total cost of reimbursements and other related actions could reach between $180 million and $400 million. The financial estimate was shared in a filing with the US Securities and Exchange Commission (SEC), where Coinbase described the costs as part of a "voluntary reimbursement" effort.

Coinbase CEO Brian Armstrong stated in a post on X that the attackers had been contacting support staff abroad for several months by offering money in exchange for customer data.

In response, Coinbase plans to improve how it handles customer data and move parts of its support operations to new locations.

On May 13, ZKsync and its development team, Matter Labs, experienced a security incident. How did it happen? Read the full story.