Coinbase Offers $20M Bounty After Insider Data Theft and Failed Extortion Attempt

May 15, 2025

Coinbase is offering a $20 million reward for information on cybercriminals who bribed support contractors and attempted to extort the exchange.

Background

Coinbase disclosed on May 15 that it had been targeted in a $20 million extortion attempt by a group of cybercriminals who compromised the company’s internal systems through bribery of customer support contractors.
According to Coinbase’s blog post, the attackers gained unauthorized access to limited user account data belonging to a small portion of customers. However, no funds, passwords, private keys, or Coinbase Prime accounts were compromised.
After obtaining the data, the group demanded a $20 million ransom in Bitcoin to prevent the disclosure of sensitive information, including government-issued IDs and personal data.
Coinbase rejected the demand and instead publicly offered a $20 million bounty for information leading to the identification and prosecution of those behind the attack.

This is one of the most high-profile insider-driven cyberattacks involving a major cryptocurrency exchange, with implications for both platform security and user trust.
Coinbase has pledged to reimburse affected users and is expected to incur between $180 million to $400 million in remediation costs related to phishing scams and this breach.
The incident highlights the growing threat of social engineering and insider threats targeting crypto platforms, especially those relying on third-party contractors for customer support.

“These insiders abused their access to customer support systems to steal the account data for a small subset of customers.”

“The attackers have been approaching overseas support agents for months. We’ve taken action and law enforcement is involved.”

“No passwords, private keys, or funds were exposed… we are offering a $20 million reward for information that leads to an arrest and conviction.”

The breach comes as Coinbase remains a top target for scammers, ranked as the most impersonated crypto brand in 2024.
This case adds to the mounting challenges exchanges face in managing cybersecurity, especially amid increased adoption and regulatory scrutiny.
Coinbase has committed to revamping its data management protocols and adjusting customer support operations to better guard against insider threats.