Cryptocurrency giant Coinbase is facing a potential financial loss between $180 million and $400 million after a cyberattack targeted less than 1% of its users. The attackers reportedly gained access by bribing external contractors and support staff based outside the United States to leak sensitive customer information such as names, addresses, and emails.
Although login credentials and passwords were not exposed, the hackers used the stolen personal details to impersonate Coinbase and trick users into transferring crypto assets. The company has promised to fully reimburse affected users who were scammed as a result of the breach.
Coinbase, which is on the verge of joining the S&P 500 index, declined to pay a $20 million ransom demanded by the hackers. Instead, it offered a $20 million reward for any information leading to the arrest of those responsible. This bold move has drawn both praise and concern as the company deals with the fallout.
The U.S. Securities and Exchange Commission (SEC) has begun examining whether Coinbase may have misrepresented data protection practices in previous disclosures. However, the company has strongly denied that its know-your-customer (KYC) systems are under investigation.
Following the announcement, Coinbase shares dropped by over 7%, adding pressure as the platform nears a significant stock market milestone. The incident has also intensified industry-wide concerns about cybersecurity, especially after $2.2 billion in digital assets were stolen globally in 2024, according to Chainalysis.
In response, Coinbase confirmed that it had fired the individuals involved and is now working closely with law enforcement. The company also announced plans to open a new U.S.-based support hub and strengthen its internal security systems. “We’re sorry for the worry and inconvenience,” Coinbase stated. “We will continue to take responsibility and improve our platform’s security.”