Coinbase

Coinbase Hit by Insider Phishing Scam, Faces Up to $400M in Reimbursement Costs

Coinbase, the third-largest crypto exchange globally, has revealed it was the target of a sophisticated insider phishing scheme that led to an attempted $20 million extortion.

In a blog post published on May 15, the company stated that cybercriminals managed to compromise customer account data by bribing contracted support staff. These external actors colluded with several overseas agents who had access to Coinbase’s internal support tools.

The breach, while serious, impacted a small portion of users—less than 1% of Coinbase’s monthly active customers. Crucially, the company confirmed that no private keys, account passwords, funds, or Coinbase Prime accounts were compromised.

After accessing the stolen data, the attackers demanded $20 million in Bitcoin in exchange for keeping the breach under wraps. Coinbase declined the demand and instead countered with a $20 million reward for any information leading to the perpetrators’ arrest and conviction.

The company also pledged to reimburse users who were victims of phishing-related scams. According to an 8-K filing with the U.S. Securities and Exchange Commission, Coinbase expects to spend between $180 million and $400 million on customer refunds and other remediation actions.

Co-founder and CEO Brian Armstrong noted on X (formerly Twitter) that the attackers had been targeting support agents for several months, trying to buy access to sensitive customer data.

In response, Coinbase plans to overhaul its internal data protection practices and shift parts of its customer service operations to new locations to minimize future risks.

Phishing and impersonation scams remain a serious issue in the crypto space. In 2024, Coinbase was the most commonly impersonated crypto brand online. Blockchain investigator ZachXBT estimated that users lost approximately $45 million to phishing scams in just the first week of May. He also claimed that annual losses to social engineering schemes affecting Coinbase users may exceed $300 million.