Coinbase Hack: 69,000 Customers Hit via Bribed Staff
Cryptocurrency exchange Coinbase confirmed on Wednesday that a months-long security breach starting in December 2024 has compromised the personal and financial information of at least 69,461 customers after an attacker bribed customer support employees.
How the Multi-Month Coinbase Breach Unfolded
The cryptocurrency giant officially disclosed the exact scale of the security incident in a filing with Maine’s attorney general on Wednesday, complying with the state’s data breach notification laws.
According to the regulatory filing, the unauthorized access began on December 26, 2024, and persisted undetected until earlier this month. The intrusion was only uncovered after Coinbase received a credible ransom note from the threat actor claiming possession of sensitive customer data.
The $20 Million Ransom Demand
In a detailed blog post, Coinbase revealed that the hacker demanded a $20 million ransom payment to delete the stolen databases. Coinbase refused to pay the extortionists.
Instead, the company’s internal investigation exposed an insider threat vector: the hacker successfully bribed Coinbase customer support workers to abuse their access credentials and view customer accounts over a period of several months.
What Customer Data Was Compromised?
The stolen data set contains highly sensitive personal and financial identifiers, including:
- Full names and phone numbers
- Email and physical postal addresses
- Government-issued identity documents
- Account balances and complete transaction histories
The exposure of both account balances and identity documents has raised immediate concerns that high-net-worth cryptocurrency investors could be singled out for targeted phishing, social engineering, or physical security threats.
