Cointelegraph Bitcoin & Ethereum Blockchain News

Coinbase breach of May 2025: Background

Coinbase received an email unsolicited from an unknown threat agent on May 11th, 2025. The attackers claimed that they had sensitive data about Coinbase’s customers, and demanded $20 million in ransom. 

Prior to examining this breach, it’s interesting to learn how it occurred in a publicly traded company that spent millions each month on cybersecurity. In February, blockchain investigator ZachXBT reported Coinbase has seen an increase in thefts. He blamed Coinbase’s inability to control $300 million in annual losses on aggressive risk models. social engineering scams. 

ZachXBT’s table shared on X shows $65 Million stolen by users from December 2024 to January 2025. His data, which he gathered from direct messages relating to onchain thefts and Coinbase tickets, was not complete, so the actual losses may be much higher. 

Cybercriminals did indeed steal valuable data on 11 May, when Coinbase posted a blog post that confirmed account balances and ID images were taken, as well as phone numbers, addresses, and bank information partially concealed.

The same actor was a threat on May 21. swapped Bitcoins have generated about $42,5 million (USD).BTCEtherETHThey used THORChain. They were using Ethereum Transaction input data written “L bozo,” ZachXBT flagged it on his Telegram Channel after ZachXBT followed up with a video meme of NBA James Worthy smoking cigars, mocking ZachXBT.

How did the Coinbase breach unfold?

Coinbase 2025 was breached in a way that wasn’t as serious. typical crypto hack Smart contracts or vulnerabilities in the blockchain. It was more like an IT security breach, with insider manipulating, corporate espionage, and extortion attempts.

Here is an overview of the events that took place:

• Information theft and insider recruiting began. Cyber attackers unknown began hiring customer service agents (based overseas in India) who were working for Coinbase. They were paid insiders to release sensitive information about Coinbase customers, including internal documents and documentation relating to customer service systems and account management. These stolen details were intended to be used in future impersonation schemes targeting users.
• Termination of employees and detection of security breaches: The internal security team at Coinbase eventually discovered suspicious activities linked to the employees. The company terminated the staff immediately and notified all affected customers. The breach was significant, even though only 69,461 Coinbase accounts were affected, which is a small fraction of Coinbase users.
• Extortion attempt via email (May 11, 2025): Coinbase has received an uninvited email from a person claiming that they have access to internal details of the system and personally identifiable data (PID). It was confirmed in a SEC 8-K filing that the email had been sent by Coinbase. 
• Coinbase refused to pay a $20M ransom on May 14, 2025 Coinbase decided to take the offensive instead of accepting extortion. Coinbase reported the hack to authorities, made it public and promised a reward of $20 million for any information that led to their arrest. They turned defense into offensive. 
• Breach notification and Public Disclosure: Coinbase announced the security breach publicly shortly after the SEC filed, detailing the extent and nature of attack. Data breach notifications were filed Maine Attorney General’s Office, which officially states that 69,461 people were affected. 

This timeline shows the different ways a crypto-company responded to an attempt at cyber-extortion. It demonstrates how they used transparency, resistance and aggressive countermeasures. It may change the way that companies react to cyber-criminals.

Did you Know? North Korea’s Lazarus Group stole over $6 billion worth of crypto from 2017 to 2025, including the record-breaking amount of $1.46 Billion stolen by Bybit. 

What information was exposed in the Coinbase breach of 2025?

A notification sent by Coinbase stated that attackers were seeking this information to conduct social engineering. They could use the information to make themselves appear more credible and convince victims to transfer their money.

Coinbase outlined the information that the threats actors could access and the rest they were not able to. 

What the attackers have

• Email, name, phone number and address
• Government‑ID images (e.g., driver’s license, passport)
• The last four numbers of the Social Security number are masked
• Account Data (balance snapshots, transaction history).
• Some bank account numbers are masked and others not.
• Limitation of corporate data available (documents, training materials, and communication to agents).

What the attackers didn’t have

• Login credentials, or two-factor codes
• Private keys
• Coinbase Prime Accounts
• The ability to transfer or access funds of customers
• You can access any Coinbase hot or cold wallet or Coinbase customers

Did you Know? Crypto.com has lost 30 million dollars from 483 account in 2022. They initially claimed that no money was stolen. However, later they admitted to the hack and reimbursed victims. This highlights the importance of being transparent in cryptocurrency hacks.

Coinbase responds to 2025 data breach

Coinbase has implemented a strategy in response to 2025’s data breach to minimize damage, assist affected users, and improve its security.

Coinbase’s key actions include:

• Refusal of ransom payment: Coinbase refused the ransom of $20 million demanded by attackers. Coinbase instead established a reward fund of $20 million for any information that leads to arrest or conviction.
• Customer reimbursements: It committed to reimburse customers that were duped into sending money due to this breach. Estimated cost for reparation and reimbursement range Between $180 and $400 Million
• Protection against theft services All affected customers will receive a complimentary year’s worth of credit monitoring services and identity protection. The company will provide credit monitoring services as well as a policy of $1,000,000 insurance reimbursement, identity restoration and monitoring the dark web to see if personal data appears in illicit online platforms.
• Customer protection: The affected accounts will need additional ID verification when making large withdrawals. They also require mandatory scam-awareness messages to help prevent future social engineering attacks.
• Support operations are strengthened: Coinbase will open a new customer support centre in the US. The company has increased security monitoring and controls across its entire network to protect against insider threats.
• Law enforcement agencies and collaboration The company has a close working relationship with US law enforcement and other international agencies. The company terminated the insiders who were involved in this breach and sent them to criminal prosecution.
• Communication and Transparency: Coinbase immediately informed the affected customers as soon as it was made aware of the security breach. This company provides regular updates on the security breach, and what steps are being taken to resolve it.

Coinbase has taken these measures to demonstrate its commitment to protecting customers and its proactive approach in addressing cybersecurity issues.

Did you Know? Crosschain bridgesNomad Bridge and other complex bridges will lose $190 million by 2022. smart contract vulnerabilities. Hackers love these bridges because they contain massive amounts of crypto-assets, which makes them attractive targets.

What to do in case of a data breach similar to Coinbase

You should be proactive in protecting yourself against social engineering scams, especially after the recent large-scale breaches of data on crypto platforms. 

What you can do to protect yourself in an emergency:

• Don’t share your sensitive data with impersonators Scammers pose as security or support agents following a data breach. You may be pushed to move funds into crypto wallets You can find sensitive data that they have shared with you in various text messages. Never ever share your password. two-factor authentication (2FA) No codes or recovery phrases. No crypto exchange You will be asked to send cryptos to an a “new” You can also find out more about “safe” wallet. 
• Allow the listing of wallet addresses to be displayed: Some exchanges offer this option, which limits withdrawals to wallet addresses that you control. The feature prevents transfers from being made without your permission, even if you account is compromised. 
• Enable 2FA strong: Use a hardware key for 2FA or an authentication app that you trust. Use a hardware security key or a trusted authentication app for 2FA. 
• Do not accept unsolicited messages: If someone claims to represent a crypto-platform and requests security credentials, or asset transfers from you, hang up the phone immediately. Never respond to emails or texts from unknown senders with personal details. 
• Lock first, investigate later: Report the incident via the official channels to Customer Support if you feel that your account is being used by someone else. 
• Keep informed To avoid new scams, it is important to regularly review the security information and updates provided by your crypto-service.