Coinbase: support agents bribed, customer data stolen, and a $20m ransom refused

In May 2025, Coinbase revealed that criminals had paid support agents to copy customer data, then demanded $20m. The company refused and offered a reward instead. What it teaches about internal access.

In May 2025, cryptocurrency platform Coinbase disclosed that criminals had bribed some of its customer support agents, based abroad and linked to outsourced operations, to copy customer data. On 11 May, the company received an email demanding $20m not to publish it.

What was stolen

• Names, contact details, the last four digits of US social security numbers, masked bank details and images of ID documents.
• According to Coinbase, no passwords, two-factor codes or private keys were affected.
• The company said fewer than 1% of its monthly transacting users were concerned.

The goal: better scams

The criminals wanted a list of real customers with accurate details, so they could call them while pretending to be Coinbase and convince them to move their funds. Stolen data is often the raw material for a scam, not the end goal.

Coinbase’s response

• It refused to pay and announced a $20m reward for information leading to the attackers’ arrest.
• It fired the agents involved, who had been flagged by its own monitoring.
• It warned affected customers and committed to reimbursing those who had been tricked.
• It estimated the total cost could reach up to $400m.

Lessons for any business with a support team

• Give support agents access only to the data they need, and mask the rest.
• Monitor access without a business reason, such as an agent viewing many unrelated accounts.
• Tell customers clearly what you will never ask them by phone or message.
• Apply the same rules to contractors as to employees.

The most dangerous access is sometimes the one you gave yourself.

Sources: Coinbase SEC filing and blog, The Register, Help Net Security, NBC, May 2025.

Want a customer area with access rights that match each role? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.