While the threat actors managed to steal a combination of personally identifiable information of up to 1% of Coinbase's customer base (around 1 million individuals), they couldn't steal customers' private keys or passwords, and couldn't access Coinbase Prime accounts and hot or cold wallets (belonging to affected customers or the crypto exchange). While the financial impact is still being assessed and Coinbase didn't reveal how many customers were deceived into sending funds to the attackers in follow-up social engineering attacks, the company estimates that the resulting expenses will be "within the range of approximately $180 million to $400 million" for remediation and customer reimbursements. Coinbase added that it will open a new support hub in the U.S., reimburse affected customers tricked into sending funds to the attackers following social engineering attacks, and increase investments in insider‑threat detection, security threat simulation, and automated response to prevent future breach attempts. Coinbase, a cryptocurrency exchange with over 100 million customers, has disclosed that cybercriminals working with rogue support agents stole customer data and demanded a $20 million ransom not to publish the stolen information. These insiders abused their access to customer support systems to steal the account data for a small subset of customers," Coinbase said in a Thursday blog post. The disclosure comes after the criminals behind the breach emailed Coinbase on May 11, demanding a $20 million ransom to prevent public disclosure of stolen information about certain customer accounts and internal documentation. "Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks. The company also advised customers to be suspicious of scammers impersonating Coinbase employees and attempting to trick them into transferring funds or asking them for sensitive information such as passwords or 2FA codes. According to Coinbase, the attackers obtained this customer data with the help of contractors or support staff outside the U.S. who were paid to access internal systems.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 15 May 2025 13:29:55 +0000