Hackers Had Access to Coinbase Customer Data Since January: Report

Following the current Coinbase $400 million breach, it has been revealed that hackers gained unauthorized entry to delicate buyer knowledge as early as January.

An individual conversant in the matter mentioned the attackers had fixed entry by bribing customer support representatives, finally demanding a $20 million ransom.

Culprits Bribed Overseas-Primarily based Help Workers

Based on a Bloomberg report, the perpetrators focused workers and contractors based mostly exterior the USA who had been a part of Coinbase’s enterprise course of outsourcing operations.

By paying off a small group of insiders, they had been capable of get delicate consumer info. The stolen knowledge included names, delivery dates, addresses, government-issued ID numbers, banking particulars, account balances, and creation dates. This info may very well be used to impersonate both Coinbase or its prospects and doubtlessly entry different monetary accounts.

“It’s a serious breach, the quantity of non-public info shared is staggering,” mentioned Mike Dudas, managing accomplice at web3 agency 6MV and a sufferer of the assault.

The supply claimed that the hackers had entry to consumer knowledge since January, however Coinbase Chief Safety Officer Philip Martin disputed this. He defined that when the agency was conscious of the knowledge sharing, permission was revoked, therefore the culprits didn’t have fixed entry all through the interval.

Nevertheless, he acknowledged that there have been a number of bribery incidents, with Coinbase first detecting indicators of suspicious exercise from the help brokers months earlier than the Might 11 ransom demand. Following this, the implicated brokers had been instantly quarantined and fired.

Particulars From the Breach

The trade disclosed the scenario to the general public in a Thursday announcement. In a weblog put up, it revealed that lower than 1% of month-to-month transacting customers had been affected by the incident. The attackers aimed to construct an inventory of shoppers to impersonate Coinbase and trick customers into handing over their crypto belongings. When the $20 million ransom demand was rejected, the unhealthy actors elevated their extortion makes an attempt.

The corporate clarified that login credentials, non-public keys, and Prime accounts weren’t compromised, and no buyer wallets had been accessed. In response to the breach, Coinbase has mentioned it is going to reimburse any customers who misplaced cash and increase its inner safety methods. It additionally introduced plans to open a brand new U.S.-based buyer help hub.

As well as, the agency launched a $20 million bounty for info resulting in the attackers’ arrest, tagged stolen funds for restoration, and is working with authorities to pursue legal prices in opposition to the concerned insiders.

The incident provides to a rising record of cyberattacks focusing on the trade. A current report by Immunefi highlighted that crypto tasks misplaced $92.5 million in April 2025 alone throughout 15 separate assaults. This determine is a 27.3% enhance from the $72.6 million misplaced in April 2024, and greater than double the $41.4 million recorded in March 2025.