Coinbase Refuses a $20 Million Bitcoin Ransom After Insider-Assisted Data Theft
Attackers bribed overseas Coinbase support personnel to obtain customer data, then demanded $20 million in Bitcoin; Coinbase refused and offered a matching reward for information leading to arrests.
On May 11, 2025, a threat actor contacted Coinbase after obtaining customer information through a campaign that bribed or recruited overseas support personnel. The attackers demanded $20 million in Bitcoin and threatened to exploit or expose the stolen data. Coinbase disclosed the incident publicly on May 15.
The compromised information included sensitive customer records useful for social engineering, but Coinbase said the breach did not expose passwords, private keys, or funds directly from its systems. The danger came from combining identifying information with account details so that attackers could impersonate Coinbase personnel and trick users into moving assets themselves. Coinbase fired the employees involved, refused the ransom demand, and announced a $20 million reward fund for information leading to the attackers’ arrest and conviction.
The company estimated that remediation and customer reimbursements could cost roughly $180 million to $400 million. The episode illustrated a recurring weakness in centralized Bitcoin infrastructure: even when private keys and cryptographic systems remain uncompromised, customer-support access and social engineering can create a route to theft. The later investigation and arrests belong to a separate stage and are not folded into the May event.