Cryptonews Features

Coinbase Attack: What We Know, and Why It Matters

Adoption

Bitcoin Brian Armstrong Coinbase

Cryptocurrency

Ethereum

Coinbase is vowing to press criminal charges against anyone involved in the attack, and some funds have been stolen.

Features writer

Connor Sephton

Features writer

Connor Sephton

About Author

Connor Sephton is a journalist based in London, who also works for Sky News and the BBC as a radio newsreader and online reporter. He has covered crypto since 2018 — reporting from major conferences...

Author Profile

Last updated:

May 15, 2025

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Coinbase has revealed that cybercriminals demanded $20 million in Bitcoin in an audacious extortion attempt targeting the exchange and its customers.

The trading platform says fraudsters convinced “a small group” of its customer service agents to leak sensitive information belonging to users.

Full names, addresses, phone numbers and email were included, along with partial social security numbers and bank account details. Images of ID obtained during the Know Your Customer process were handed over, along with balance snapshots.

Coinbase has stressed that only a small number of customers were affected — less than 1% of those who use the exchange each month — but make no mistake, such a security vulnerability is acutely concerning.

It’s believed the cybercriminals wanted to use this intelligence to contact unsuspecting users while pretending to be from Coinbase, winning their confidence by sharing information that only the exchange would know.

This could easily deceive people into handing over the crypto sitting securely in their account.

https://t.co/evpIBMFvRW pic.twitter.com/f6UPdkL5R0
— Brian Armstrong (@brian_armstrong) May 15, 2025

Explaining what happened in a detailed blog post, Coinbase stressed anyone who was tricked into sending funds as a direct result of this exploit will be made whole. Meanwhile, accounts identified as being affected by this incident are going to be monitored more closely, especially when it comes to large withdrawals.

“A new support hub” is also going to open in the U.S., with the exchange vowing to increase investment in preventing attacks that come from within the organization. Any users caught up in this breach have already been informed.

Coinbase has also moved to reassure concerned users that private keys and login credentials were not impacted by this exploit — and the cybercriminals were never able to move customer funds or access the exchange’s hot and cold wallets.

The malicious actors had told the trading platform that they wanted $20 million to cover their actions up, but executives at the exchange refused. Instead, this cash is being offered as a reward for information that leads to the attackers being arrested.

Coinbase has confirmed that stolen funds are being traced through blockchain analytics — and when it came to the staff members involved, it warned:

“Insiders were fired on the spot and referred to U.S. and international law enforcement. We will press criminal charges.”

There is precedent for this. Two years ago, a former Coinbase product manager was jailed after tipping off his brother with information about which new coins were going to be listed on the exchange, enabling them to make a profit.

Going forward, the trading platform has given a simple message to its millions of users worldwide: expect imposters. It’s stressed that Coinbase will never call with a new seed phrase, ask for passwords, or for funds to be transferred.

“If you receive this call, hang up the phone. Coinbase will never ask you to contact an unknown number to reach us.”

Other top tips include establishing strong two-factor authentication measures, locking accounts as a precaution if something doesn’t feel right, and setting up strict permissions that mean crypto can only be sent to wallets you fully control. Apologizing for the breach, Coinbase added:

“Crypto adoption depends on trust. To the customers affected, we’re sorry for the worry and inconvenience this incident caused. We’ll keep owning issues when they arise and investing in world‑class defenses — because that’s how we protect our customers and keep the crypto economy safe for everyone.”

There are several key takeaways following on from this incident. First, Coinbase should be praised for its transparency, and comprehensive explanation about what happened, how it reacted, and what’s on offer to affected customers.

But there are also serious questions concerning the safeguards in place to prevent employees within crypto firms from going rogue and acting against the best interests of the users they’re meant to serve. And, unfortunately, this is the latest in a long line of incidents that may discourage newcomers from trying digital assets.

The breach also takes the shine off what has otherwise been a good week for Coinbase, which recently revealed that it’s joining the flagship S&P 500 index. In a video posted on X, CEO Brian Armstrong added:

“We’re actually relocating some of our customer support operations as a result of this … For the would-be extortionists or anyone seeking to harm Coinbase customers, know that we will prosecute you and bring you to justice.”