Coinbase, was hit by a extortion attempt after cybercriminals successfully bride and worked in cahoots with several customer support contractors to access internal systems and steal limited user account data.
After stealing the data, the attackers attempted to extort $20 million worth of Bitcoin from Coinbase in exchange for not disclosing the breach.
Instead of giving it to the criminal's demands, the company has offered the same amount of money to white-hat hackers who can help Coinbase in catching those responsible for the scheme.
In a X post, Coinbase revealed that some "insiders" provided external actors with access to customer data, but the number of Coinbase users affected was less than 1%.
The company has declined to say how much customer information was accessed, but it assured that no passwords, private keys, funds were exposed, and Coinbase Prime accounts remain unaffected.
Coinbase has since terminated the involved insiders and is cooperating with U.S. and international law enforcement. In an interview with Fortune, it was also revealed that all these insiders worked in India.
The company also pledged to reimburse users who were tricked into sending cryptocurrency to phishing scammers, with expected remediation and reimbursement expenses estimated between $180 million and $400 million.
The estimate was written in an 8-K Filing with the U.S Security and Exchange Commission on May 15. Coinbase has classified these expenses under the category of voluntary customer reimbursement and other remediation efforts.
Armstrong revealed that the attackers have been vying over the exchange's overseas customer support agents for months, finding numerous ways and ideas to bribe them in exchange for customer information.
https://t.co/evpIBMFvRWpic.twitter.com/f6UPdkL5R0
— Brian Armstrong (@brian_armstrong) May 15, 2025
a
To further protect users, Coinbase is relocating some customer support operations to the U.S. and enhancing internal security protocols.
The company has also introduced mandatory scam-awareness prompts for flagged accounts and recommends enabling withdrawal allow-listing and two-factor authentication.
Cryptocurrency exchanges are top targets for hackers and other cybercriminals, as bitcoin and other cryptocurrencies work outside of traditional banking systems and are often difficult to retrieve if stolen.
Blockchain security analysts estimate that Coinbase users lost $45 million to phishing schemes in the week leading up to May 7, with annual losses exceeding $300 million.
The incident has also contributed to a 6% decline in Coinbase’s stock price following the disclosure.
Japan’s public transport is using AI to make it easier and faster to find lost items. The system matches photos and details to a large database, helping return more belongings to their owners.
WeatherlyBhutan has launched the world’s first national crypto tourism payment system, letting visitors pay for everything from flights to local goods using digital currencies like Bitcoin and BNB. The system, built with Binance Pay and DK Bank, helps local businesses—especially in remote areas—accept crypto payments easily.
AnaisA stealthy phishing tactic called "tabnabbing" is alarming cybersecurity experts. It changes inactive browser tabs to mimic login pages, tricking even cautious users into revealing credentials through routine browsing.
CatherineThe Solana Name Service (SNS) launched its $SNS token with a 40% airdrop to reward long-time supporters and attract new users. The move follows SNS’s shift from FIDA to focus on decentralised identity using .sol domains, but concerns over market volatility and a lack of roadmap remain.
AnaisA hacker gained access to sensitive US government data through a vulnerability in the TeleMessage app, which is used for archiving encrypted communications. The breach exposed personal details of government employees and raised concerns about the security of third-party communication tools.
AnaisStripe has introduced stablecoin-based accounts in 101 countries, allowing businesses to send, receive, and hold balances in USDC and USDB. This move targets markets facing banking challenges and strengthens Stripe's position in the growing crypto and cross-border payments sector.
WeatherlyA Russian hacking group, Cold River, deployed new malware called "LOSTKEYS" to steal sensitive data from high-profile Western targets. The malware uses deceptive tactics to infiltrate systems and gather intelligence, marking an escalation in Cold River's cyber espionage activities.
WeatherlyMeta announced on 7 May that it removed over 23,000 scam accounts and Pages targeting users in Brazil and India. The scammers used fake celebrity videos and impersonation to promote fraudulent investment and gambling apps.
WeatherlyArizona has passed a new law allowing the state to take control of unclaimed cryptocurrency after three years. The assets will be managed in a reserve fund, with profits made through staking and airdrops—without using taxpayer money.
AnaisRipple and the SEC have filed a joint motion to finalise a $50 million settlement and lift the injunction, moving to close their long-running case. However, SEC Commissioner Crenshaw strongly opposes the deal, warning it weakens investor protections and sends the wrong message to crypto firms.
Anais