Coinbase Rejects $20M Ransom, Pledges Same Bounty After Insider Leak Hits 1% of Users
By: crypto news|2025/05/15 23:17:05
0
Share
$20 million ransom demand flipped into a matching bounty when Coinbase disclosed this week that bribed overseas support staff leaked partial data on less than 1% of its users, reigniting fears of insider threats across crypto exchanges.Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on https://t.co/SidVn59JCV— Coinbase (@coinbase) May 15, 2025The crypto exchange says a group of rogue agents were bribed by cybercriminals to copy sensitive data, which was then used in a social engineering campaign to impersonate Coinbase and defraud users.Although no customer funds, passwords, or private keys were accessed, the attackers obtained partial personal information, including names, contact details, masked Social Security and bank account numbers, and in some cases, images of government-issued IDs. Coinbase emphasized that Coinbase Prime users were not impacted and that no direct access to hot or cold wallets was ever at risk.“We’re committed to full transparency,” Coinbase said in a public statement, “and instead of giving in to the $20 million ransom demand, we’re establishing a $20 million reward fund to bring the criminals to justice.”The Anatomy of the AttackAccording to Coinbase, the breach occurred when criminals targeted overseas support agents and offered them financial incentives to participate in the scheme. A small number of insiders accepted the bribes and abused their privileged access to copy data stored in customer support tools.The attackers then attempted to extort the company, threatening to release the stolen information unless Coinbase paid a $20 million ransom. The exchange declined the demand, opting instead to notify affected users and bolster its internal and external security infrastructure.The stolen data included transaction histories, account balances, and some internal documentation accessible to support agents. However, the attackers did not obtain passwords, two-factor authentication codes, private keys, or access to any wallets, thus preventing direct theft of funds.Coinbase’s Response and Customer SupportIn response to the breach, Coinbase has pledged to reimburse retail customers who were tricked into sending funds to scammers through social engineering tactics. These reimbursements will be made after a thorough review process. Affected accounts are now subject to increased withdrawal security protocols, including additional ID checks and scam-awareness prompts.Coinbase said it is also taking steps to reinforce its global support operations. For example, a new customer support hub is being established in the United States, and enhanced insider-threat detection systems are being rolled out across all service locations.The company has intensified internal simulations to stress-test its security infrastructure and isolate potential vulnerabilities.All impacted users have received direct communication, and Coinbase is working closely with law enforcement agencies both in the U.S. and internationally. The rogue employees involved were immediately terminated and referred for criminal prosecution.A Call for AccountabilityRather than succumbing to extortion, Coinbase said it is offering a $20 million reward for information that leads to the arrest and conviction of those responsible for the breach. Anyone with credible information is encouraged to contact the company at security@coinbase.com. In parallel, Coinbase and its partners have tagged crypto wallet addresses associated with the attackers to aid in asset recovery.Coinbase is also reminding users to stay vigilant against scams and impersonators. Customers are urged to never share passwords or 2FA codes, and to lock their accounts immediately if something seems suspicious.“Trust is foundational to crypto adoption,” Coinbase said in its closing statement. “We’re sorry for the concern this incident caused and remain committed to transparency and protecting our users at every step.”Huge Blow for the CompanyCommenting on the cyber attack on Coinbase, Nick Jones, founder and CEO at Zumo, said: “Unfortunately, as our nascent industry grows rapidly, it draws the eye of bad actors, who are becoming increasingly sophisticated in the scope of their attacks and harnessing new AI tools and techniques to bypass fraud prevention measures.”“This is understandably a huge blow for a company that has had a pivotal few weeks, announcing the acquisition of Deribit in the digital market’s largest deal to date, and then joining the S&P 500.”“This attack underlines the critical importance of robust cybersecurity measures. The European Union (EU) introduced its Digital Operational Resilience Act (DORA) earlier this year with an emphasis on financial institutions ensuring the resilience of their supply chain, promoting better data hygiene, and sharing usable insights on attacks they have experienced to strengthen the industry’s perimeter. This seems particularly pertinent as it emerges that the hack occurred when attackers bribed overseas support staff,” Jones added.The post Coinbase Rejects $20M Ransom, Pledges Same Bounty After Insider Leak Hits 1% of Users appeared first on Cryptonews.
You may also like

Business Opportunities of Tokenized Stocks
In this article, we will outline the lifecycle of tokenized stocks, analyze the current market landscape, and highlight the emerging business opportunities.

In-depth research report on the Resolv protocol hacking incident, who is the final payer?
This incident reveals a fundamental weakness in Delta's stablecoin - the coupling point between the minting logic and off-chain signatures/oracles is the most vulnerable attack surface of the system. Any capital efficiency design of "1 dollar minted for 1 dollar" must be predicated on extremely rigo...

Crypto Market Sees Large Liquidations: $272 Million in Long Positions Affected
Key Takeaways In the last 24 hours, $272 million worth of contracts were liquidated across the entire crypto…

Whale Increases BTC Shorts and Bets on Crude Oil: A Strategic Crypto Move
Key Takeaways A prominent whale, known as “UnRektCapital,” has strategically escalated its short position in Bitcoin while simultaneously…

Hackers in Brazil Use Fake Google Play Store to Steal Cryptocurrency
Key Takeaways Hackers in Brazil are exploiting fake Google Play Store pages to spread Android malware. Infected devices…

Exchanging 200,000 for nearly 100 million, DeFi stablecoins face another attack
DeFi project teams cannot assume that the modules they control are necessarily secure.

The underlying business agreement of the trillion-dollar Agent economy: Understanding ERC-8183, it's not just about payments, but the future
This article systematically analyzes the technical principles and commercial value of the ERC-8183 protocol from the dimensions of technical architecture, core mechanisms, application scenarios, and ecological collaboration.

When Wall Street's ETH begins to "yield": Looking at the asset properties of Ethereum from BlackRock's ETHB
ETH is undergoing a paradigm shift from a "volatile asset" to a "yield-generating cash flow asset."

The Power of Agency: The Agentic Wallet and the Next Decade of Wallets
In 1984, Apple killed the command line with a mouse. In 2026, Agent is killing the mouse.

Understanding x402 and MPP in One Article: Two Routes for Agent Payments
x402 makes payments within the agreement, while MPP makes system-level payments.

Particle Founder: The entrepreneurial insights I have gained the most from in the past year
Stop lean startup, stop lightning entrepreneurship, and think carefully about what your product aspirations are.

Huang Renxun's latest podcast transcript: The future of Nvidia, the development of embodied intelligence and agents, the explosion of inference demand, and the public relations crisis of artificial intelligence
The competition in the future is not just about whose model is larger or whose computing power is stronger, but also about who understands the industry better, who can embed AI more deeply into real processes, and who can organize these capabilities into a runnable and scalable system.

OKX Ventures Research Report: AI Agent Economic Infrastructure Research Report (Part 1)
The existing infrastructure is hostile to the Agent economy. Agents can think and act independently at the "capability level," but at the "economic level," they are still locked into infrastructure designed for humans.

The migration of settlement rights: B18 and the institutional starting point of on-chain banks
In the traditional system, banks decide the settlement; in the on-chain system, code begins to take over this responsibility.

From Tencent and Circle: Looking at the Simple and Difficult Questions of Investment
The AI narrative continues to ferment, but the recent performance of related stocks varies, with some in the midst of summer and others as if in winter.

The second half of stablecoins no longer belongs to the crypto circle
What Coinbase doesn't want, Mastercard is eager to buy.

Cursor "Shell" Kimi Controversy Reversed: From Copyright Infringement Allegations to Authorized Collaboration, China's Open Source Model Once Again Becomes a Global AI Foundation
Cursor was accused of being based on Kimi K2.5, which sparked controversy, and was later confirmed to be compliant through Fireworks AI due diligence.

The Real Reason Tokens Don't Sell: 90% of Crypto Projects Overlook Investor Relations
Provide an Investor Relations Best Practices Guide for Crypto Projects.
Business Opportunities of Tokenized Stocks
In this article, we will outline the lifecycle of tokenized stocks, analyze the current market landscape, and highlight the emerging business opportunities.
In-depth research report on the Resolv protocol hacking incident, who is the final payer?
This incident reveals a fundamental weakness in Delta's stablecoin - the coupling point between the minting logic and off-chain signatures/oracles is the most vulnerable attack surface of the system. Any capital efficiency design of "1 dollar minted for 1 dollar" must be predicated on extremely rigo...
Crypto Market Sees Large Liquidations: $272 Million in Long Positions Affected
Key Takeaways In the last 24 hours, $272 million worth of contracts were liquidated across the entire crypto…
Whale Increases BTC Shorts and Bets on Crude Oil: A Strategic Crypto Move
Key Takeaways A prominent whale, known as “UnRektCapital,” has strategically escalated its short position in Bitcoin while simultaneously…
Hackers in Brazil Use Fake Google Play Store to Steal Cryptocurrency
Key Takeaways Hackers in Brazil are exploiting fake Google Play Store pages to spread Android malware. Infected devices…
Exchanging 200,000 for nearly 100 million, DeFi stablecoins face another attack
DeFi project teams cannot assume that the modules they control are necessarily secure.