Coinbase support-contractor data breach and downstream thefts hack — December 2024

Criminals paid overseas customer-support contractors working for Coinbase to copy customer records out of internal systems. In a Form 8-K filed on 15 May 2025 Coinbase said the threat actor obtained the data by paying multiple contractors or employees in support roles outside the United States. The data included names, addresses, phone numbers, email addresses, the last four digits of Social Security numbers, masked bank account details, government ID images, account balances and transaction history. Passwords, private keys and customer funds were not directly accessed, and Coinbase said its hot and cold wallets were untouched.

Coinbase received an extortion email on 11 May 2025 demanding $20 million, refused to pay, referred the matter to the Justice Department and offered a $20 million reward instead. Its notification to the Maine Attorney General put the number of affected customers at 69,461 and dated the start of the unauthorised access to 26 December 2024. A class-action filing reported by Fortune places the first thefts by a contractor at an Indore, India service centre several months earlier and says participants were paid about $200 per screenshot.

The money was taken downstream: callers armed with the stolen data impersonated Coinbase staff convincingly enough to talk customers into sending crypto to attacker wallets. No independently verified total of customer crypto losses has been published. The dollar figure recorded here is Coinbase's own cost accounting, not a measured sum of stolen coins. The 8-K estimated $180 million to $400 million in remediation and voluntary customer reimbursement; Coinbase's second-quarter 2025 results recorded $307 million.