Coinbase, one of the world’s largest cryptocurrency exchanges, has disclosed a cyber-attack that could cost the company up to $400 million.

The breach occurred after hackers bribed overseas customer support agents to steal sensitive customer data, which was then used in social engineering attacks.

The attackers obtained personal information – including names, addresses, phone numbers, email addresses, partial Social Security numbers, and government ID images – for less than 1% of Coinbase’s monthly transacting users. However, the hackers did not gain access to passwords, private keys, or customer funds.

Coinbase refused to pay a $20 million ransom demand, instead launching a reward fund for information leading to the arrest and conviction of those responsible. The company has also pledged to reimburse customers who lost funds due to the scam.

“Instead of funding criminal activity, we have investigated the incident, reinforced our controls, and will reimburse customers impacted by this incident,” Coinbase stated.

As well as pledging to reimburse customers who were ‘tricked into sending funds to the attacker due to social engineering attacks,’ the company is also implementing additional safeguards, including stricter ID checks for large withdrawals, mandatory scam warnings, and closer monitoring of high-risk transactions – which may cause delays.

To bolster security, Coinbase has said that it is opening a U.S.-based support hub, enhancing controls across all locations, and investing in insider-threat detection and automated response systems.

https://t.co/evpIBMFvRW pic.twitter.com/f6UPdkL5R0

— Brian Armstrong (@brian_armstrong) May 15, 2025

Cyber-attack Comes Days Before S&P 500 Milestone

The cyber-attack comes just days before Coinbase is scheduled to join the S&P 500 index – a major milestone for the cryptocurrency industry.

The exchange will replace Discover Financial Services in the benchmark index, marking the first time a crypto company has been included.

Recommended reading

• How Much Was Lost to Crypto Phishing Scams in 2024?
• UK Crypto Groups Urge Government to Back Blockchain
• ByBit Races to Stop Lazarus From Laundering $1.5bn Crypto Haul

The S&P 500, one of the most widely followed stock market indexes, tracks 500 of the largest U.S. publicly traded companies. Inclusion requires meeting strict criteria, including profitability, a market capitalisation of at least $10 billion, and sufficient liquidity.

Don’t Miss Scotland’s Biggest Tech Event!

Join us at DIGIT Expo West on 5th June at the SEC Glasgow. Get leading industry insights across AI, Cyber Security, and Data, and grow your network at Scotland’s largest gathering of tech leaders – with 1500+ attendees, 50+ speakers, and 50+ exhibitors.

Register your FREE place now at www.digitexpowest.com