Coinbase, the largest U.S.-based cryptocurrency exchange, disclosed a significant cybersecurity breach that compromised sensitive customer data and led to an attempted $20 million extortion.
The breach was orchestrated through a social engineering campaign targeting Coinbase’s overseas customer support contractors, primarily based in India. Hackers bribed these contractors to access internal systems and extract customer data. The compromised employees have since been terminated.
The attackers obtained personal information from less than 1% of Coinbase’s 9.7 million monthly transacting users. The stolen data includes names, addresses, phone numbers, email addresses, partial Social Security numbers (last four digits), masked bank account numbers, government-issued ID images, and account data such as balance snapshots and transaction history. Importantly, no passwords, private keys, or customer funds were directly compromised.
Coinbase estimates the financial impact of remediation and voluntary customer reimbursements to range between $180 million and $400 million. The company received a $20 million ransom demand from the attackers but refused to pay. Instead, Coinbase has offered a $20 million reward for information leading to the arrest and conviction of those responsible.
While no funds were directly stolen, the exposed personal information could be used in phishing or impersonation scams. Coinbase has pledged to fully reimburse customers who were tricked into transferring funds to the attackers.
Recommended Actions for Customers:
- Enable two-factor authentication (2FA) on your Coinbase account.
- Be cautious of unsolicited communications claiming to be from Coinbase.
- Use withdrawal allow-listing to restrict transfers to known addresses.
Following the breach announcement, Coinbase’s stock (COIN) dropped by approximately 6%. Despite this setback, the stock remains up 22% for the month and is poised to join the S&P 500 index.
This incident underscores the importance of robust security measures, especially in the rapidly evolving cryptocurrency sector. While Coinbase has taken steps to address the breach and protect its customers, users should remain vigilant and take proactive measures to secure their accounts.
