Coinbase: Revealed a customer data breach

Coinbase , one of the world's largest cryptocurrency exchanges, has suffered a data breach . The company revealed that malicious actors — with the help of support employees — gained access to internal systems and stole user data , demanding a $20 million ransom to keep it from being made public.

Coinbase said it would not give in to the attackers' demands. Instead, it announced the creation of a special fund, also worth $20 million, which will act as a reward for anyone who provides information that could lead to the identification of those responsible.

The incident came to light when hackers contacted the company directly via email (May 11), threatening to release "sensitive information" from internal documents and customer accounts.

See also: Germany shuts down crypto exchange service eXch

Internal sabotage

According to Coinbase’s internal investigations, the data breach was possible thanks to the attackers’ collaboration with external partners or support employees of the company, outside the United States. The employees were bribed to grant access to critical internal systems. The perpetrators were identified and removed from the company, although the damage had already been done.

Coinbase: Limited but serious data breach

Although hackers managed to obtain personally identifiable information (PII) for up to 1% of its customer base — about one million people — Coinbase assures that was compromised private keys, passwords , or funds. Coinbase Prime accounts and hot or cold wallets were also not accessed.

In an official filing with the US Securities and Exchange Commission (SEC), Coinbase confirmed that the data that was compromised includes:

• Name, address, phone and email
• Social Security Number (last four digits only)
• Masked bank account numbers and certain bank account identifiers
• Government ID images (e.g. driver's license, passport)
• Account data (balance snapshots and transaction history)
• Limited corporate data (including documents, training materials, and communications made available to support representatives)

Another bell for security in the crypto world

The incident serves as a reminder that, despite the impressive technological infrastructure of cryptocurrency exchanges, the human factor remains the most vulnerable point. Coinbase seems determined to further strengthen its internal control processes, but the case proves that even the giants of the space are not immune to cyber threats.

See also: Celsius founder Alex Mashinsky convicted of crypto fraud

Although the full economic impact is not yet known, Coinbase estimates that the cost of restoration and compensation could reach up to $400 million.

In response to the incident, the company announced the following measures:

• Creation of a new customer service hub within the United States
• Compensating customers who were tricked into sending money to attackers after social engineering attacks
• Expanding investments in insider threat detection and automated incident response technologies
• Establish stricter access management protocols

Following the disclosure of the data breach, Coinbase is urging its customers to be especially wary of scammers pretending to be company employees, aiming to extract sensitive information or trick them into transferring funds.

The company clarifies that it never requests data such as passwords or two-factor authentication (2FA) codes over the phone, nor does it encourage users to transfer funds to other wallets. In such cases, it is recommended to immediately stop the communication.

Basic precautions recommended by Coinbase:

• Enable two-factor authentication (2FA)
• Use of a “whitelist” for withdrawals, which allows funds to be transferred only to approved addresses

In a statement, the company said: “We apologize for the inconvenience and disruption. We are committed to taking responsibility and continuously strengthening our defenses to keep the crypto ecosystem safe for everyone.”

Coinbase said it will compensate customers who were tricked into transferring funds to the attackers, as long as the transfer was made as a direct result of the breach and before the date of the official announcement. The process will include verification of the incidents.

See also: Hackers use New York Post's X account for crypto fraud

Coinbase: Data Breach

The breach suffered by Coinbase is particularly troubling, not only because of its scale, but mainly because of the way it was carried out: through internal sabotage by customer support. This dimension of the case illuminates one of the most difficult problems in cybersecurity: the insider threat.

While Coinbase was able to limit the damage—no private keys, funds, or sensitive infrastructure were stolen—the fact that user personal data was stolen is serious. This type of information (name, email, ID images, etc.) is particularly valuable for attacks social engineering and phishing scams.

This case serves as a wake-up call for the entire crypto industry and more generally for any platform that manages sensitive personal or financial data.

Source: www.bleepingcomputer.com