https://www.cnbc.com/2025/05/15/coinbase-says-hackers-bribed-staff-to-steal-customer-data-and-are-demanding-20-million-ransom.html Skip Navigation logo logo Markets * Pre-Markets * U.S. Markets * Currencies * Cryptocurrency * Futures & Commodities * Bonds * Funds & ETFs Business * Economy * Finance * Health & Science * Media * Real Estate * Energy * Climate * Transportation * Industrials * Retail * Wealth * Sports * Life * Small Business Investing * Personal Finance * Fintech * Financial Advisors * Options Action * ETF Street * Buffett Archive * Earnings * Trader Talk Tech * Cybersecurity * AI * Enterprise * Internet * Media * Mobile * Social Media * CNBC Disruptor 50 * Tech Guide Politics * White House * Policy * Defense * Congress * Equity and Opportunity Video * Latest Video * Full Episodes * Livestream * Live Audio * Live TV Schedule * CNBC Podcasts * CEO Interviews * CNBC Documentaries * Digital Originals Watchlist Investing Club * Trust Portfolio * Analysis * Trade Alerts * Meeting Videos * Homestretch * Jim's Columns * Education * Subscribe * Sign In Join IC PRO * Pro News * My PortfolioNEW! * Livestream * Full Episodes * Stock Screener * Market Forecast * Options Investing * Chart Investing * Stock Lists * Subscribe * Sign In Join Pro Livestream Menu * Make It * select * USA * INTL * Livestream Search quotes, news & videos * Livestream Watchlist SIGN IN logo Markets Business Investing Tech Politics Video Watchlist Investing Club Join IC PRO Join Pro Livestream Menu Markets Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom Published Thu, May 15 20258:13 AM EDTUpdated 4 Hours Ago Tanaya Macheel@tanayamacheel WATCH LIVE In this article * COIN * BTC.CM= Follow your favorite stocksCREATE FREE ACCOUNT Jakub Porzycki | Nurphoto | Getty Images Coinbase on Thursday reported that cybercriminals bribed overseas support agents to steal customer data to use in social engineering attacks. The incident may cost Coinbase up to $400 million to fix, the company estimated. The crypto exchange operator received an email on May 11 from someone claiming they obtained information about certain Coinbase customer accounts as well as other internal Coinbase documentation, including materials relating to customer service and account management systems, Coinbase reported in a Securities and Exchange Commission filing. The company's shares were down more than 6% in morning trading. The email demanded money in exchange for not publicly disclosing the information, but Coinbase says it has not paid the demand and is cooperating with law enforcement on the investigation of the incident. Although passwords and private keys were not compromised, affected data included sensitive data such as names, addresses, phone numbers and emails; masked bank account numbers and identifiers as well as the last four digits of Social Security numbers; government ID images and account balances, the company said. "Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks," the company said in a blog post. "These insiders abused their access to customer support systems to steal the account data for a small subset of customers. No passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched. We will reimburse customers who were tricked into sending funds to the attacker." Coinbase had detected the breach independently in previous months, per the filing. It immediately terminated the employees involved, warned customers whose information may have been accessed and enhanced its fraud monitoring protections. The threat actor paid overseas contractors and employees in support rolls to obtain the information, it said. "We're cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received," the company said in the blog. "Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack." Coinbase operates the largest crypto exchange in the U.S. In the past week it announced an acquisition that is expected to help it expand its global reach and gained entry to the benchmark S&P 500 stock index, which will take effect next week. On the earnings call last week, CEO Brian Armstrong discussed his ambition to make Coinbase "the No. 1 financial services app in the world" in the next five to 10 years. Don't miss these cryptocurrency insights from CNBC Pro: * Stablecoins to hit $2 trillion in the next three years and spur demand for Treasurys, says Standard Chartered * Why bitcoin is trading like 'Mag 8' and not digital gold in tariff uncertainty, according to Galaxy's Novogratz * Bitcoiners take a victory lap as crypto holds up well during market turmoil CNBC logo * * * * * * * * Subscribe to CNBC PRO * Subscribe to Investing Club * Licensing & Reprints * CNBC Councils * Select Personal Finance * CNBC on Peacock * Join the CNBC Panel * Supply Chain Values * Select Shopping * Closed Captioning * Digital Products * News Releases * Internships * Corrections * About CNBC * Ad Choices * Site Map * Podcasts * Careers * Help * Contact * News Tips Got a confidential news tip? We want to hear from you. Get In Touch * CNBC Newsletters Sign up for free newsletters and get more CNBC delivered to your inbox Sign Up Now Get this delivered to your inbox, and more info about our products and services. * Advertise With Us Please Contact Us * Privacy Policy * California Consumer Privacy Act (CCPA) Opt-Out Icon * CA Notice * Terms of Service (c) 2025 CNBC LLC. All Rights Reserved. A Division of NBCUniversal Data is a real-time snapshot *Data is delayed at least 15 minutes. Global Business and Financial News, Stock Quotes, and Market Data and Analysis. Market Data Terms of Use and Disclaimers Data also provided byReuters logo