By CoinbaseMay 15, 2025 • 5min readTl;dr: Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks. These insiders abused their access to customer support systems to steal the account data for a small subset of customers. No passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched. We will reimburse customers who were tricked into sending funds to the attacker. We’re cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.Security and transparency are core to Coinbase. Consistent with that commitment, we’re publicly detailing an extortion attempt against us and our customers. Instead of funding criminal activity, we have investigated the incident, reinforced our controls, and will reimburse customers impacted by this incident.What happenedCriminals targeted our customer support agents overseas. They used cash offers to convince a small group of insiders to copy data in our customer support tools for less than 1% of Coinbase monthly transacting users. Their aim was to gather a customer list they could contact while pretending to be Coinbase—tricking people into handing over their crypto. They then tried to extort Coinbase for $20 million to cover this up. We said no.What they gotName, address, phone, and emailMasked Social Security (last 4 digits only)Masked bank‑account numbers and some bank account identifiers Government‑ID images (e.g., driver’s license, passport)Account data (balance snapshots and transaction history)Limited corporate data (including documents, training material, and communications available to support agents)What they didn’t getLogin credentials or 2FA codesPrivate keysAny ability to mov