# Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused · pwn.watch

> Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Page: https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025 · generated 2026-10-22T20:45:43.249Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Coinbase customer support systems
- Started: 2025-05-11 · closed: 2025-05-30
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025/feed.xml
- JSON Feed: https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025.json
- This file: https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025/llms.txt

## Updates (newest first)
- 2025-05-15: Coinbase discloses the breach in an SEC filing and refuses the $20M ransom (https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm)
- 2025-05-11: Coinbase receives the extortion demand and discovers the breach (https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/)
- 2025-05: Breach notice puts affected customers at 69,461 (https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/)
- 2024-12-26: Unauthorized access begins (per breach notification) (https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/)

## Fix brief
# Security brief: Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

Source: https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025 · status: closed (closed May 30, 2025) · severity: high · updated May 30, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Severity detail: Insider-enabled data breach; extortion

- Product: Coinbase customer support systems

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- May 15, 2025: Coinbase discloses the breach in an SEC filing and refuses the $20M ransom
- May 11, 2025: Coinbase receives the extortion demand and discovers the breach
- May 2025: Breach notice puts affected customers at 69,461
- Dec 26, 2024: Unauthorized access begins (per breach notification)

## Advisories
- [Coinbase Form 8-K (2025-05-14)](https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm) (SEC)

## Write-ups & news
- [Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom](https://www.cnbc.com/2025/05/15/coinbase-says-hackers-bribed-staff-to-steal-customer-data-and-are-demanding-20-million-ransom.html)
- [Coinbase warns of up to $400 million hit from cyberattack](https://www.reuters.com/business/coinbase-says-cyber-criminals-stole-account-data-some-customers-2025-05-15/)
- [Coinbase says recent data breach impacts 69,461 customers](https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/)

## Caveats
startedAt uses the discovery date (May 11, 2025); access began Dec 26, 2024. closedAt approximate.

---
Machine-readable: https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.