Coinbase discloses data breach caused by bribed support agents and refuses to pay US$20 million ransom
The largest US crypto exchange told the SEC that criminals paid support agents to copy customer data and demanded US$20 million not to release it. The company refused and estimates a cost of up to US$400 million.
Historical reference: May 20, 2025. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- On May 15, 2025, Coinbase told the SEC that criminals bribed overseas support agents to copy customer data from internal tools.
- The attackers demanded US$20 million not to release the information. Coinbase refused and set up a reward of the same amount for information leading to those responsible.
- The company estimates spending between US$180 million and US$400 million on fixes and reimbursement. Passwords, private keys and funds were not accessed.
- The real risk is the fake support scam: with a name, phone number and balance in hand, the criminal sounds convincing. The rule is never to transfer funds at the request of someone who calls or writes to you.
São Paulo, May 20, 2025 — Coinbase, the largest crypto asset exchange in the United States, disclosed on May 15, in a statement to the market and in a filing with the SEC, the US securities regulator, that it suffered a customer data breach. The company's systems were not broken into: according to Coinbase, criminals paid customer support agents, hired outside the United States, to copy information from internal tools. They then tried to extort the company.
- ransom demanded by the criminals, refused by Coinbase
- US$20 mn
- of monthly transacting users had data exposed, according to the company
- < 1%
- estimated cost of fixes and reimbursements, according to the SEC filing
- US$180–400 mn
What happened
- Months earlierCoinbase's monitoring identifies improper access to customer data by overseas agents, who are dismissed.
- May 11The company receives an extortion email: the criminals say they have customer data and demand US$20 million not to release it.
- May 15Coinbase discloses the case, refuses to pay and announces a US$20 million reward for information leading to the arrest and conviction of those responsible.
According to the company, the attackers recruited customer support agents and bribed them to obtain data from internal tools. The exact timeline of the leak and the final number of people affected are still under investigation, and Coinbase itself calls its estimates preliminary.
What was exposed and what was not
| Exposed | Not exposed |
|---|---|
| Name, address, phone number and email | Passwords and two-factor authentication codes |
| Last 4 digits of the US Social Security number | Private keys |
| Masked bank account numbers and some bank identifiers | Hot and cold wallets |
| Images of identity documents | Coinbase Prime accounts |
| Balances and transaction history of some accounts | Access to move customer funds |
Data of this kind does not allow anyone to touch a balance, but it gives the criminal the script for a conversation. Someone who knows your name, phone number, email, approximate balance and last transaction can easily pass for an exchange employee.
Cost and the company's response
Coinbase estimated that the incident will cost between US$180 million and US$400 million, adding up remediation, customer service and reimbursement to customers. It committed to voluntarily reimbursing retail customers who were induced to send funds to scammers as a direct consequence of the breach. It also tightened controls, opened an operations center in the United States and dismissed those involved. The decision not to pay the ransom was explained as a way of not funding new attacks.
The case shows a trend: instead of breaking encryption, the criminal pays someone who already has access. This applies to any company with outsourced customer service, not just exchanges. See another example in the Bybit attack, which also exploited trust in an interface, not a code error.
The scam that comes next: fake support
With the data in circulation, the risk shifts to the customer. The pattern is familiar: the scammer calls, messages or emails claiming to be from the exchange, cites correct data to earn trust and claims a threat (“your account was hacked”) to ask the customer to move funds to a “safe wallet” or install a remote access program. It is the same mold as the Brazilian fake call center scams, described in scams that exploited the fake Pix tax.
How to protect yourself
- Treat any unsolicited contact in the name of the exchange as suspicious, even if it cites correct data about you.
- Enable two-factor authentication through an app or a physical key, not by SMS.
- Use the withdrawal address allowlist, if the platform offers one, to limit where funds can go.
- Keep most of your assets in your own wallet and leave on the exchange only what you need to trade.
- For a company that pays suppliers: restrict who can authorize transfers and use dual approval. The wallet registration controls described in the guide against address poisoning also block a fake agent's request.
A phone call does not prove who the caller is. Hang up, open the official app and confirm there. If the contact was legitimate, the exchange will have a record; if it was a scam, you lose nothing.
Frequently asked questions
What happened to Coinbase in May 2025?
The company announced on May 15 that criminals bribed overseas support agents to copy customer data and demanded US$20 million not to release it. Coinbase refused to pay, offered a reward of the same amount for information on those responsible and said funds, passwords and private keys were not accessed.
Were my funds at Coinbase at risk?
According to the company, no. The breach affected registration data and documents, not access credentials, private keys or the ability to move funds. The indirect risk is social engineering scams that use this data.
How does the fake exchange support scam work?
The criminal poses as an employee, cites real customer data and invents an emergency, such as an account takeover, to ask for a transfer of funds, a verification code or the installation of remote access. The defense is to end the contact and confirm through the official channel.
How much loss did Coinbase estimate?
Between US$180 million and US$400 million, including reimbursement to deceived customers, according to the SEC filing. The company described the amount as a preliminary estimate.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Coinbase suffers data breach, gets extorted (but won’t pay) · Help Net Security, May 15, 2025
- Coinbase disclosed a data breach after an extortion attempt · Security Affairs, May 15, 2025
- Form 8-K, Coinbase Global, Inc., item 1.05 (incidente de segurança cibernética) · SEC, May 15, 2025
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
