Summary
In May 2025, Coinbase disclosed that cybercriminals had bribed overseas customer-support contractors to steal personal data on about 69,461 customers, then used that data to run convincing scams against Coinbase users. The insiders had legitimate access to support tools for their jobs; they abused it to pull records they had no business reason to see. No passwords, private keys, two-factor secrets, or customer funds were taken. The attackers demanded a $20 million ransom to stay quiet. Coinbase refused, offered a $20 million bounty for information leading to their arrest instead, and estimated the cleanup and customer reimbursements at $180 million to $400 million in an SEC 8-K filing.
How to fix it
- Immediately revoke access for implicated agents and force-rotate support-tool sessions and credentials.
- Notify affected users with breach-specific anti-phishing guidance, naming exactly which data was exposed so they can recognize impersonation.
- Reimburse direct-loss victims and provide identity-protection coverage; cooperate with law enforcement and do not pay extortion, which only funds the next campaign.
How to avoid it in your code
- Enforce least-privilege support tooling: agents see only what a given ticket needs, PII is masked or tokenized by default, and bulk record browsing is blocked.
- Monitor data access for "no business need" patterns, abnormal record volumes, and off-hours bulk views; Coinbase's own monitoring is what detected the insiders.
- Add physical anti-exfiltration controls on support floors (no personal phones or cameras, DLP on screenshots and copy-out), since the theft here was photographing screens.
- Govern outsourced support vendors tightly (background checks, segregation of duties, contractual security obligations) and avoid over-reliance on a single low-cost provider.
- Teach customers that real support never asks them to move funds, share two-factor codes, or use a "safe wallet," and offer allow-listed withdrawal addresses.
Advisory details
How it happened
The data did not leak through a software flaw. A criminal group paid support agents and contractors working outside the United States (at the outsourcer TaskUs in Indore, India) to collect information from the internal Coinbase systems they used every day. These were customer-service and account-management dashboards the agents were authorized to use; the abuse was accessing customer records without any business need, and in at least one alleged case photographing screens. What they exfiltrated was substantial: names, addresses, phone numbers, and emails; masked Social Security numbers (last four digits); masked bank-account details; government-ID images; and account balances and transaction history. What they could not reach was just as important: no login credentials, no private keys, no two-factor secrets, and no ability to move customer funds.
How it surfaced
Notably, Coinbase did not first learn of this from the criminals. Its own monitoring had already detected personnel accessing data without a business need in the preceding months, and Coinbase had terminated them and warned affected customers. On May 11, 2025, an extortion email revealed the bigger picture: the rogue access had been part of a coordinated campaign that succeeded in exfiltrating data, and the attackers wanted $20 million to suppress disclosure. Coinbase refused to pay, set up a $20 million reward fund for information leading to the attackers' arrest and conviction, and filed an SEC 8-K on May 14 that pegged preliminary remediation and voluntary reimbursement costs at $180 million to $400 million.
The downstream harm
The stolen records were the fuel for the real attack: social engineering. Armed with a victim's real name, partial SSN, and balance, attackers impersonated Coinbase support convincingly enough to talk users into moving crypto into attacker-controlled wallets, the same data-extortion-to-fraud pipeline seen across the industry. Coinbase committed to reimburse eligible retail customers who were tricked into sending funds as a direct result of the breach. It also terminated the implicated agents, ended its relationship with the outsourcer, offered affected users a year of identity-protection monitoring, and announced a new US-based support hub to reduce reliance on offshore support. At least one former agent was reported arrested in India.
Why it matters
This is an insider-and-vendor risk story, not a hacking story, and that is what makes it hard. The technique, turning a trusted help-desk into an access broker, is the same human-layer move that powers help-desk social-engineering crews like the one behind MGM and Caesars, and it is methodologically close to the support-desk attacks that fed breaches like Snowflake customer data theft. The exposed data was masked, but masked is not harmless: partial identifiers plus real balances are precisely what makes a phishing call land. The defenses are unglamorous: least-privilege support tooling, hard limits on bulk record access, behavioral monitoring (which is what caught it here), and physical anti-exfiltration controls on support floors.
References
- https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm
- https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists
- https://www.cnbc.com/2025/05/15/coinbase-says-hackers-bribed-staff-to-steal-customer-data-and-are-demanding-20-million-ransom.html
- https://www.bleepingcomputer.com/news/security/coinbase-discloses-breach-faces-up-to-400-million-in-losses/
- https://www.bleepingcomputer.com/news/security/coinbase-breach-tied-to-bribed-taskus-support-agents-in-india/
Related vulnerabilities
All OpSec →- HIGHOPSEC-INTERNET-ARCHIVE-2024
The Internet Archive, the nonprofit behind the Wayback Machine, had a brutal October 2024: a data breach, a website defacement, and a wave of DDoS attacks, all at once. Underneath the chaos was an unglamorous root cause. An authentication token sat in plain text in a public config file; the team rotated it repeatedly, but each new token landed right back in the same exposed file, so the leak never actually closed. With it, an attacker downloaded the source code, found more credentials hardcoded inside, and walked out with a database of 31 million users. Weeks later a second token from that same stolen code, for the support system, exposed 800,000 support tickets, some with people's ID documents. It is the lesson that rotating a secret is useless if it goes straight back into a public file, and that one leak unravels everything.
- HIGHOPSEC-MERCEDES-BENZ-2024
Publicly disclosed January 30, 2024, a Mercedes-Benz employee accidentally committed a GitHub authentication token to a public repository, leaving it exposed from September 29, 2023. RedHunt Labs found the token during an internet-wide scan; it granted unrestricted, unmonitored access to Mercedes-Benz's internal GitHub Enterprise Server, allowing anyone to download private source-code repositories that could contain API keys, cloud access keys, database connection strings, blueprints, and SSO passwords. After notification, the token was revoked on January 24, 2024. Mercedes-Benz stated customer data was not affected but could not confirm whether anyone besides the researchers accessed the repositories during the exposure window.
- CRITICALOPSEC-MIDNIGHT-BLIZZARD-2024
In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.
- HIGHOPSEC-OKTA-2023
Okta is an identity provider: the single front door thousands of companies use to log their employees into everything. So when Okta's customer-support system was breached in late 2023, the blast radius was a who's-who of security-conscious companies. The entry point was almost mundane. An employee had signed into their personal Google account on an Okta laptop and saved a corporate service-account password into it; the attacker got that password and walked into Okta's support system. There they downloaded diagnostic files that customers had uploaded, some of which contained live session tokens, and used those tokens to step directly into the customers' own Okta environments. It is the lesson that session tokens are as good as passwords, support systems are production systems, and a personal browser profile can be the crack in the wall.
- CRITICALOPSEC-23ANDME-2023
23andMe held the most personal data there is: people's DNA. In 2023 attackers got into more than 18,000 accounts and, through a single social feature, turned that into the genetic and ancestry data of roughly 6.9 million people. The break-in required no flaw in 23andMe at all. Attackers simply took username-and-password pairs leaked from other companies' breaches and tried them, betting, correctly, that people reuse passwords. The accounts had no MFA, and 23andMe did not notice the five-month wave of automated logins. From those footholds, the attackers scraped relatives' data through an opt-in feature, and the fallout, fines, a $50 million settlement, and ultimately bankruptcy and a fire-sale of the DNA database itself, shows that a breach can be fatal even when your own systems were never hacked.
- HIGHOPSEC-MICROSOFT-SAS-2023
Microsoft's AI research team shared open-source training data via an Azure Storage Shared Access Signature (SAS) token committed to a public GitHub repo around July 2020. The token was misconfigured to scope access to the entire storage account with full-control permissions instead of the intended read-only bucket, so anyone with the link could view, delete, and overwrite files. Wiz researchers discovered it in June 2023, finding 38 terabytes of exposed internal data including two employees' workstation disk backups with secrets, private keys, passwords, and over 30,000 internal Teams messages. Writable pickle-format models created a model-poisoning supply-chain risk; Microsoft revoked the token and reported no customer data was exposed.