Coinbase says hackers accessed a “small subset” of users' data, but not credentials, expects to incur $180M to $400M in costs, and refuses to pay a $20M ransom

Coinbase (COIN.O) forecast a hit between $180 million and $400 million from a cyber attack that breached account data of a …

Reuters 2025-05-15 Niket Nishant

Context & Ripple Effects

This incident fits a recurring Coinbase security arc: the company previously disclosed an SMS multi-factor-authentication weakness that led to customer crypto theft, while this event is described as exposing account data rather than credentials. Related reporting says the attackers gained access by bribing customer-service representatives, making the support operation—not only login security—a central part of the breach boundary.

The projected cost range shows that a breach can create a large financial exposure even when passwords and authentication data are said not to have been accessed. A subsequent filing detailed the types of personal and account information involved, underscoring the sensitivity of the data at issue in the later breach-impact disclosure.

First-order effects

Coinbase must absorb an estimated $180 million to $400 million in incident-related costs while handling a ransom demand it says it will not pay.
Affected users face heightened exposure from compromised account and personal data, even though Coinbase says credentials were not accessed.

Second-order effects

Coinbase is likely to tighten access controls, monitoring, and oversight around customer-support workflows after reporting tied the intrusion to bribed customer-service representatives.
Other crypto platforms and their outsourced support providers face pressure to treat employee and contractor access as a core security risk, rather than relying primarily on customer login protections.

Third-order effects

If such incidents persist, crypto-platform security spending will shift further toward defending multiple account-takeover paths—including internal access and recovery processes—rather than focusing solely on authentication technology.
The episode points to a broader allocation-of-loss question: as breaches expose data without directly exposing credentials, platforms, users, and insurance-like products may increasingly dispute which resulting fraud losses are covered.

The trend: Crypto platforms are confronting a widening security perimeter in which privileged support access can generate material breach costs even without a direct credential compromise.

Discussion

@zackwhittaker.com Zack Whittaker on bluesky
BREAKING: Coinbase says it was breached, and customers' personal information stolen. — The crypto giant said the hacker was “paying multiple contractors or employees working in support roles,” and contacted Coinbase with a ransom demand this week with stolen data, which Coinbas…
@self.agency Daniel Sieradski on bluesky
even the top tier crypto platform, under more scrutiny and more stringently regulated than all others, has gaping security holes that enable the theft of customers' assets [embedded post]
@zackwhittaker.com Zack Whittaker on bluesky
More: Coinbase CEO says the hacker demanded $20 million in a ransom payment not to publish the stolen data. — A Coinbase spokesperson tells me that less than 1% of its monthly customers are affected. Per its latest figures out in March 2025, that's still around ~100k people wh…
@zackwhittaker@mastodon.social Zack Whittaker on mastodon
Coinbase CEO says the hacker demanded $20 million in a ransom payment not to disclose the data. Coinbase says less than 1% of customers had data stolen, but Coinbase had at least 108 million customers as of a few years ago, suggesting at least a million customers could be affect…
@brian_armstrong Brian Armstrong on x
[video]
@coinbase @coinbase on x
Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on <1% of Coinbase MTUs. No passwords, private keys, or funds were exposed. Prime accounts are untouched. We will reimburse impacted customers. More here: https://coinbase.com/...
@coinbase @coinbase on x
We will pursue the harshest penalties possible and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.
@evgenygaevoy @evgenygaevoy on x
Coinbase not disclosing this (much much much...) earlier notwithstanding, this is the dark side of the idiotic and nonsensical kyc/aml regime we live in making life marginally convenient for law enforcement and geopolitical games, while sacrificing our privacy, imposing a
@tayvano_ Tay on x
Kids steal >$50m every weekend via Coinbase CEX account takeovers. Coinbase has failed to understand, detect, or stop these for over a year. Coinbase instead decided to build a feature that gives scammers a direct, encrypted line to all their wallet users. Incredible.
@zerohedge @zerohedge on x
Coinbase files 8K saying they were hacked https://www.sec.gov/...
@jeffjohnroberts Jeff Roberts on x
Never seen this before: a smart way to fight back against hackers — and a masterclass in PR Crooks bribed support agents in India to steal @coinbase customer data—and then tried to blackmail the firm for $20M to stay quiet https://fortune.com/...
@atabarrok Alex Tabarrok on x
Brian Armstrong just pulled a Mel Gibson on Coinbase ransomers. I love this guy, https://m.youtube.com/...
@tmnxeq @tmnxeq on x
oh wow, CB also filed an update with the SEC formally discloses a “Material Cybersecurity Incident” & related estimated expenses of approximately “$180 million to $400 million” [image]
@lemiscate @lemiscate on x
The only effective way to safeguard users from data breaches is to refrain from collecting and storing data. Aave is a 40 billion dollar protocol that has no idea of who you are. Just use Aave.
@tmnxeq @tmnxeq on x
kyc docs (partially) leaked too... sounds like a huge data access issue at CB [image]
@cobie @cobie on x
@Arthur_0x Happens at every exchange. Most of them don't disclose it publicly
@federicotenga Federico Tenga on x
Can these huge platforms with thousands of CS people have any hope of keeping the users' data safe? KYC laws not only are ineffective, but they also require trust assumptions towards employees that can only work at a small scale
@inversebrah @inversebrah on x
💀💀💀 [image]
@r89capital Rex on x
If no funds were exposed, what are they reimbursing?
@tmnxeq @tmnxeq on x
fascinating that Coinbase did *not* disclose this $180m-400m Cybersecurity Incident as part of past week's 10-Q it took the “extortion email” (dated May 11, Sunday) to file disclosures 🤨 [image]
@mayazi Maya Zehavi on x
The biggest attack vector that exposed ppl are the centralized honey pots that aggregate various PiI under one roof & then fail to protect it. Boggles my mind why crypto native companies haven't found a way to integrate decentralize directory primitives to protect their users. [i…
@phildaian @phildaian on x
addresses and IDs leaked? with everything that is going on in crypto right now? federal investigation now. this is a life or death matter. unacceptable. -a coinbase customer
@mdudas Mike Dudas on x
i'm humbled to be part of the 1% [image]
@arthur_0x Arthur on x
Coinbase really need to get their shit fixed, there is no ground to ask for constant KYC refresh when it just end up as a honeypot of user's important information.
@tmnxeq @tmnxeq on x
coinbase admits data leak (rogue employees) impacted: “less than 1% of Coinbase monthly transacting users” what a weird way to measure the scope of the leak probably to sugarcoat the scope — coinbase does not provide the total amount of accounts impacted
@tmnxeq @tmnxeq on x
guess this weird story around a “$20 million ransom demand” is a PR spin to hide the true nature of the announcement (disclosing the data breach to cb users) blog is titled: > Protecting Our Customers - Standing Up to Extortionists 🤡 https://x.com/...
r/cybersecurity r on reddit
Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom
r/Buttcoin r on reddit
Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom
r/technology r on reddit
Coinbase says customers' personal information stolen in data breach

Chronicles