Cyber-Attack Timeline: Coinbase

FAQs on the Coinbase Cyber Attack

• 1. What happened in the Coinbase cyber attack?

  In May 2025, Coinbase — the largest cryptocurrency exchange in the United States — disclosed that cyber criminals had bribed and recruited rogue overseas customer-support agents and contractors to steal personal data belonging to less than 1% of its monthly transacting users. Rather than breaching Coinbase's systems technically, the attackers used insiders to obtain the data, then attempted to extort the company. No passwords, private keys or customer funds were exposed, and Coinbase Prime accounts were untouched. Coinbase refused the ransom demand and instead offered a $20 million reward for information leading to the attackers' arrest, while estimating remediation and reimbursement costs at $180 million to $400 million.

• 2. When did the Coinbase cyber attack take place?

  The insider-led data theft is reported to have begun around January 2025 and continued for several months before detection — by one industry executive's account, for nearly five months undetected. Coinbase received an extortion email from the threat actor on 11 May 2025, disclosed the incident in an 8-K filing with the US Securities and Exchange Commission (SEC) on 14 May 2025, and CEO Brian Armstrong went public via a video on X on 15 May 2025. The US Department of Justice confirmed it had opened a probe on 19 May 2025.

• 3. Who was behind the Coinbase cyber attack?

  The threat actor was not publicly identified. Rather than exploiting a technical vulnerability, criminals bribed overseas contractors and customer-support agents — Coinbase's own outsourced support staff — to hand over customer data in exchange for cash. An unknown actor then emailed Coinbase on 11 May 2025 claiming to hold the stolen customer information and internal documentation, and demanded payment. No named individual or group had been formally attributed at the time of reporting.

• 4. How did the attackers gain access to Coinbase data?

  The attackers did not hack Coinbase's infrastructure. Instead, they bribed and recruited rogue overseas support agents and contractors who had legitimate access to internal customer-service and account-management systems, paying them cash for sensitive user information. This makes it an insider-threat and social-engineering attack rather than a technical intrusion — a reminder that people and outsourced third-party functions are a primary attack surface.

• 5. What data was stolen in the Coinbase breach?

  The stolen data included customers' names, home and email addresses, phone numbers, dates of birth, partial Social Security numbers, masked bank-account numbers, images of government IDs such as driver's licenses and passports, and Coinbase account balances and transaction histories. The attackers also took internal company documentation relating to customer-service and account-management systems. Login credentials, passwords, blockchain private keys and customer funds were not compromised.

• 6. How many Coinbase customers were affected?

  Coinbase reported that less than 1% of its monthly transacting users were affected. While the proportion was small, the information stolen about those customers was significant and well-suited to targeted impersonation and social-engineering scams.

• 7. Was a ransom demanded, and did Coinbase pay it?

  Yes, a ransom was demanded but Coinbase refused to pay. The threat actor demanded $20 million to suppress the stolen data. Rather than pay, CEO Brian Armstrong publicly declined, stating the company would not fund criminal activity, and Coinbase turned the figure around by offering a $20 million reward for information leading to the arrest and conviction of those responsible.

• 8. How much did the Coinbase cyber attack cost?

  In its filing with the SEC, Coinbase estimated the cost at between $180 million and $400 million, covering remediation costs and voluntary customer reimbursements. The company cautioned that this figure could change as a result of potential losses, indemnification claims and potential recoveries. These are company estimates rather than final, confirmed totals.

• 9. How did the attack affect Coinbase's share price?

  Financial press reported that news of the disclosure pushed Coinbase shares down by around 4.1%, and that the stock fell roughly 6% in trading around midday on 15 May 2025, the day the incident was made public. The movements were attributed to investor reaction to the breach disclosure and the estimated remediation costs.

• 10. What was the attackers' goal in the Coinbase breach?

  Rather than directly draining accounts, the attackers aimed to harvest victims for follow-on social-engineering and business-impersonation scams. The stolen personal data allowed them to contact customers while posing as Coinbase support and attempt to trick them into transferring their funds to attacker-controlled accounts. The theft of internal customer-service documentation supported making those impersonation attempts more convincing.

• 11. How did Coinbase respond to the cyber attack?

  Coinbase had independently detected the suspicious activity in the months before disclosure, immediately terminated the employees and contractors involved, and warned affected customers. It enhanced its fraud-monitoring protections, disclosed the incident in an 8-K filing with the SEC, refused the ransom demand and offered a $20 million reward. Coinbase notified and worked with the US Department of Justice and other US and international law enforcement agencies, and issued a public apology to affected customers.

• 12. What can organisations learn from the Coinbase cyber attack?

  The Coinbase incident shows that attackers do not always need to break in technically — they can simply bribe insiders. The key lessons are that outsourced and third-party support staff need strict least-privilege access, monitoring and segregation of duties; insider-threat detection matters as much as perimeter security; sensitive customer data should be minimised and tightly governed; and both staff and customers need awareness training to resist social-engineering and impersonation scams. A tested incident response plan and a clear ransom-decision position also help leaders respond with confidence. Cyber Management Alliance helps organisations build these capabilities through training, cyber crisis tabletop exercises and incident response planning.