The Blubber

Coinbase, the largest U.S.-based cryptocurrency exchange, revealed Thursday that cybercriminals had illegally accessed customer data in a scheme to steal crypto — and are now demanding a $20 million ransom to keep the stolen information private.

CEO Brian Armstrong stated on social media that bad actors had bribed several overseas customer service agents to hand over sensitive customer information, including names, birth dates, and partial Social Security numbers.

“This kind of data enables them to launch social engineering attacks — calling our users while pretending to be Coinbase support in an attempt to deceive them into transferring their crypto to the attackers,” Armstrong said.

Social engineering is a common tactic among hackers, exploiting human vulnerabilities rather than technological ones. In recent years, this method has led to high-profile breaches at numerous major companies.

Coinbase has not disclosed how many users were impacted or how many fell victim to scams, but the company has committed to reimbursing affected customers.

In a filing with the Securities and Exchange Commission (SEC), Coinbase estimated its costs related to the incident — including customer reimbursements and remediation efforts — could range from $180 million to $400 million.

The filing also revealed that in recent months, some customer support agents were found accessing user data without a valid business reason. Those employees have since been terminated, and Coinbase says it has increased its fraud prevention measures.

The attackers reportedly contacted Coinbase this past Sunday, threatening to publish the stolen data unless paid $20 million in bitcoin.

Armstrong said Coinbase is refusing to negotiate with the extortionists. Instead, the company is offering a $20 million reward for information leading to their arrest.

“To the criminals behind this — or anyone who would target our users — know this: we will find you, and we will pursue justice,” Armstrong said. “And my answer is no.”