ClosedHighNo fix needed

Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

Coinbase customer support systems

Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Why this severity: Insider-enabled data breach; extortion

Started: May 11, 2025
Closed: May 30, 2025

Follow this incident

Updated May 30, 2025

Affected

Fixed in

No fixed release yet

Timeline4

May 15, 2025
Coinbase discloses the breach in an SEC filing and refuses the $20M ransom
Source
May 11, 2025
Coinbase receives the extortion demand and discovers the breach
Source
May 2025
Breach notice puts affected customers at 69,461
Source
Dec 26, 2024
Unauthorized access begins (per breach notification)
Source

Advisories1

Coinbase Form 8-K (2025-05-14)SEC

News & write-ups3

Notes & caveats

startedAt uses the discovery date (May 11, 2025); access began Dec 26, 2024. closedAt approximate.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified