HN Reader

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

416

496

4 days agoby gpi

Direct link to SEC filing:

https://www.sec.gov/ix?doc=/Archives/edgar/data/0001679788/0...

3 days agoby tomhow

I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening feature takes good care of the rest. Wish I could forward them to Kitboga[1].

I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves.

[1] https://www.youtube.com/watch?v=HNziOoXDBeg

3 days agoby modeless

The problem is that it seems like the data that leaked is also the data that would be used to do account recovery.

And what that means is that

1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore.

2) Hackers can try to “recover” accounts now using this leaked info.

This is a huge problem. What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)

The only solution here is: hardware 2 factor like yubikeys.

3 days agoby thepasswordis

I tried to reach out to coinbase customer support to see if I was impacted. Once I wasted my time with the AI bot and got a human they were unaware of the breach. I was the first person to inform them about it.

3 days agoby sgarman

And the reason Coinbase has to keep all that sensitive stuff, much more than what would be required to identify and authenticate you, which you hope will never be stolen, is because of know your customer laws, so you can thank your government that pictures of your passport got stolen and for whatever criminals and rogue Coinbase employees do with that info.

3 days agoby molticrystal

Coinbase seems to be going to great lengths to try and distance themselves from the so-called "rogue overseas support agents".

If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom.

Reimbursing duped customers makes sense, as it seems like they would have a pretty straightforward case to make in court that Coinbase's actions led to their loss.

I'm more curious if someone who feels the need to move, change banks, change their email, hire a security detail etc. could successfully sue the company to recover some or all of those costs.

3 days agoby rkagerer

> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities

Based on the information present in the breach, I think it's likely that the source was their customer support in the Philippines. Monthly salary is usually < 1000$/month (entry-level probably even less than 500$) and a 5000$ bribe could be more than a year worth of money, tax-free. Considering the money you can make with that dataset now, this is just a small investment.

> •Name, address, phone, and email; •Masked Social Security (last 4 digits only); •Masked bank-account numbers and some bank account identifiers; •Government‑ID images (e.g., driver’s license, passport); •Account data (balance snapshots and transaction history); and •Limited corporate data (including documents, training material, and communications available to support agents).

This is every threat actor's dream. Even if you only had email addresses and account balances, this is a nightmare. Instead of blackmailing the company, you can now blackmail each individual user. "Send me 50% of your BTC and I won't publish all of your information on the internet". My guess is that we will have a similar situation like we had with the Vastaamo data breach...

https://en.wikipedia.org/wiki/Vastaamo_data_breach

3 days agoby mafriese

Blog post is here:

https://www.coinbase.com/blog/protecting-our-customers-stand...

> We will reimburse customers who were tricked into sending funds to the attacker due to social engineering attacks. If your data was accessed, you have already received an email from no-reply@info.coinbase.com; all notifications went out at 7:20 a.m. ET on 5/15 to affected customers.

3 days agoby skybrian

Whatever you think of Coinbase, this is a pretty good response IMO:

> and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible

4 days agoby hypeatei

> the Company has preliminarily estimated expenses to be within the range of approximately $180 million to $400 million relating to remediation costs

Hopefully companies take this as a lesson about bottom dollar outsourcing your CS.

For those amounts, they could afford to have hired regionally local support agents, and paid them well over industry standard...

3 days agoby silisili

> Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.

I’m not usually a huge fan of crypto folks, but I applaud this.

I hope they are serious about paying the reward, and aren’t planning to rug-pull it.

3 days agoby ChrisMarshallNY

A few days ago I missed a delivery from UPS (in the UK). The next day I got a text from an unrecognised cell phone that just said “Hello” and didn’t respond further. The day after that I got a scam call (another UK cell number) from someone trying to hack into my Amazon account. They wanted me to supply the OTP code that Amazon texts you for 2FA. Anyway I eventually tracked down my package (it was at a convenience store awaiting pick up), and lo and behold they had printed my phone number along with name/address on the package. I suspect someone harvested that and passed it to the scammers (not necessarily a UPS employee, could be the drop off locations they contract with). I suppose I’ll report it to the police in the slim hope that it will help them catch the scammers.

3 days agoby Tycho

Why did those employees have access to such sensitive data? We could argue about the legal requirement to submit this data in general, but I really don't understand why (most of) this data isn't stored in an encrypted way and only accessible by a few people in the company.

3 days agoby I_am_tiberius

Video response from Coinbase's CEO: https://x.com/brian_armstrong/status/1922967787309256807

4 days agoby forix

There should be an ISO standard with respect to how much power and information that front line customer support agents have. The more information you need, like changing passwords or accessing personal information, should get forwarded to higher level customer support agents with better training and more monitoring. This way you can design customer support experience with as little exposure to security issues as possible.

4 days agoby blindriver

So this is probably why the phishing calls have increased from ~1 per month to ~3 per week.. good to know... Wish coinbase would let me DO something about it... Maybe fresh accounts for everyone? Maybe KYC data not directly linked to accounts? There should be SOMETHING they can do because the sheer volume of people constantly harassing CB customers is nuts.

3 days agoby elif

I'm having de ja vu here. If they only found out when they attempted to extort them does it mean they don't even bother to log employee access? Is there any means for accountability at all internally?

It would be so simple to have access tracking and flag or lock out rogue employees... I look forward to seeing what the golden parachutes look like.

3 days agoby J0nL

If you want to be alerted to new/updated SEC cybersecurity filings, you can subscribe to my free alerts [1] or see the full index of cybersecurity incidents [2] on my tracker (I check SEC EDGAR every 5 mins).

[1] https://www.board-cybersecurity.com/alerts/

[2] https://www.board-cybersecurity.com/incidents/tracker/

3 days agoby ahoog42

Maybe it’s a naive question, but in many breach reports I see things like 'No passwords, private keys, or funds were exposed.' How come companies can usually protect that kind of data, but not emails, names, and other personal info?

3 days agoby pentagrama

I’ve been getting scam texts from scammers who claimed my Coinbase account was compromised and to contact them. I wonder if this incident was the root cause

3 days agoby AznHisoka

It's really unfortunate that KYC regulations required Coinbase to have this information in the first place. We should be establishing strong social norms against sharing PII without a legitimate reason; this is not just an individual theft risk but a national security risk. Coinbase doesn't pay into your Social Security account, so they shouldn't have your Social Security number. They don't visit your house, so they shouldn't have your address. Etc.

Historically, although KYC regulations were widespread in Communist countries, they were unthinkable in most democratic countries until 9/11, which provided spy agencies with their golden chance to write their wishlist into law. But unfortunately that helps foreign spy agencies just as much as, maybe more than, it helps domestic ones.

In https://en.wikipedia.org/wiki/Know_your_customer#Laws_by_cou... you can see when they were introduced in different countries.

3 days agoby kragen

> recruited a group of rogue overseas support agents

Why not just say what country the are from and how they hired them to start with. It's presented as those sneaky "overseas" people that somehow got access to our systems. This company makes what, a few billions in revenue but they couldn't vet and hire the right people?

3 days agoby rdtsc

Given how little customer support agents in cheaper countries are paid, i'm surprised this type of serious attack has not happened sooner.

Corruption in these countries is extremely common. We're used to having a government that actually works in western countries. In these cheaper countries, bribes are routine and almost unavoidable.

Given the culture of corruption and how little the support agents are paid, it was only a matter of time before some bad actor tried to bribe them. Medical bills are expensive and need to be paid, making the agents highly vulnerable to this type of attack.

For many, the choice would be to accept the bribe, or let their sick child suffer from a treatable condition.

Now that a high profile attack has happened, expect copycat attacks from other bad actors.

3 days agoby aussieguy1234

The article says they sent an email, but I usually ignore emails from Coinbase. I hope there's going to be a better way to find out if your data was breached. I was locked out of my account before, and had to upload an ID. I thought they didn't store it... :o

4 days agoby whatamidoingyo

As bad and annoying as this is, I do think “we won’t pay the ransom but set up a reward fund in the same amount to find the perps” is an interesting approach. It turns the tables such that any of the criminals or associates now are incentivized to turn on each other. I could see ways it wouldn’t work (they lie to get the reward, future scammers set up the scam with a patsy so they can collect reward), and am not sure it plays the same if there is actual exposed keys, etc.

3 days agoby shireboy

Assuming they will have to inform the individuals who's data was actually breached/taken? Or is this basically the entire customer base? In which case that is VERY bad.

3 days agoby asim

It's ironic this came [out] the day after COIN is going to be added to the SP500.

3 days agoby westonplatter0

>We will reimburse customers who were tricked into sending funds to the attacker.

How many people are going to anonymously attack themselves now, just to get a reimbursement!

3 days agoby DonHopkins

Just when it was included in S&P500 :(

3 days agoby Flex247A

Brian Armstrong (Coinbase CEO) posted a video about this today: https://x.com/brian_armstrong/status/1922967787309256807

3 days agoby olalonde

I'm surprised they only demanded $20M. Surely that customer data is potentially worth, like, potentially orders-of-magnitude more.

Correspondingly I'd assume either a) paying the ransom doesn't take it off the market or b) the info they stole isn't that interesting.

3 days agoby growlNark

One more reason to ignore Coinbase’s weekly harassment email to update my information.

3 days agoby ipv6ipv4

I wonder what percentage of Coinbase's (but also any other company storing PII data) support is done by AI at this point, and whether they could focus on and invest much more heavily to make that as close as possible to 100%.

4 days agoby throwawayfour

Discussion forming (14 points, 8 comments) https://news.ycombinator.com/item?id=43994545

4 days agoby gnabgib

They've been constantly bugging me to upload my government ID, never did. Now I'm really glad I didn't.

3 days agoby revicon

"et cetera"

3 days agoby I_am_tiberius

Interesting coincidence?

>On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection.

https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647...

3 days agoby mxhold

From the Coinbase website:

https://www.coinbase.com/en-de/blog/protecting-our-customers...

    What they got

    - Name, address, phone, and email

    - Masked Social Security (last 4 digits only)

    - Masked bank‑account numbers and some bank account identifiers 

    - Government‑ID images (e.g., driver’s license, passport)

    - Account data (balance snapshots and transaction history)

Wow. Why does customer support staff have access to images of the user's passports?

3 days agoby ArtTimeInvestor

Hats off to the hackers for getting through to Coinbase support

4 days agoby seviu

The article keeps saying overseas employees or contractors, but isn't more specific on who Coinbase entrusted with this sensitive customer PII.

The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked.

Not, "Gosh, 'overseas' people, what can ya do?"

4 days agoby neilv

Saved dimes on customer support, lost $400m.

It's hard to not believe in Karma sometimes.

4 days agoby chmod775

A few weeks ago I got this email:

Update to the Coinbase User Agreement

We are emailing you about an important upcoming update to the Coinbase User Agreement. This update will revise our Arbitration Agreement with you. We made these updates to streamline the process for resolving disputes.

You can read the entire agreement here. The revised terms are in sections 9.9, 9.10 and Appendix 6.

These terms apply only to disputes that you or we initiate after May 15, 2025. The current terms will continue to apply until May 15.

---

What date did this news come out? I see it just happens to be the same date as mentioned in this email, May 15. Coinbase sneakily is trying to prevent their customers from exercising their legal rights. If you work for Coinbase, you ought to be ashamed and quit. If you use Coinbase, remove all your assets immediately.

I'm open to hearing reasons why this is just a coincidence or I'm misinterpreting the situation. Please, go ahead.

3 days agoby babyshake

Oops, I was wrong:

From https://techcrunch.com/2025/05/15/coinbase-says-customers-pe...

> The company said the hacker stole customer names, postal and email addresses, phone numbers, and the last four-digits of users’ Social Security numbers. The hacker also took masked bank account numbers and some banking identifiers, as well as customers’ government-issued identity documents, such as driver’s licenses and passports. The stolen data also includes account balance data and transaction histories.

4 days agoby mooreds

[flagged]

4 days agoby jqpabc123

wait, coinbase has staff?

3 days agoby couchdive

... and once the crypto is transferred. Poof, you're ducked.

3 days agoby daveguy

I mean... wasn't coinbase sort of scammy to begin with? Several years ago I gave them some USD, turned it into BTC, saw the value of the BTC go up, but when I tried to cash out was told that wasn't a thing that was supported by their platform. Later I was told I could apply for a $399/year credit card and could partially pay off the balance with BTC sale proceeds. I'm sure this was all disclosed somewhere in the terms of service I clicked through, and I only lost $1000 to their scheme.

But I've always wondered why people think this is how investment vehicles work. I monkeyed around with stock market bets and even Robin Hood allows you to cash out of your positions.

4 days agoby OhMeadhbh

Employees at Signal must be getting bribes as well, or even threats of violence since they can get nation state Secret communications these days.

Got to make it so employees can’t do anything nefarious. This helps protect them.

3 days agoby sroussey