Hackers defraud Coinbase users and demand $20 million ransom

Coinbase, a prominent cryptocurrency exchange, recently disclosed a significant breach that resulted in the theft of customer data and an attempted extortion for $20 million. The company revealed that certain support staff overseas were bribed to obtain sensitive information on behalf of cybercriminals.

An unknown threat actor contacted Coinbase on May 11, informing them of the stolen data and demanding the hefty ransom to prevent a public disclosure. Although Coinbase confirmed the authenticity of the email and the stolen data, they have made it clear that they will not pay the extortionists. Instead, they have chosen to offer a $20 million reward for information leading to the arrest and conviction of the attackers.

The compromised data, belonging to less than 1% of their monthly transacting users, includes names, addresses, phone numbers, email addresses, last four digits of Social Security Numbers, masked bank account numbers, and more. While passwords and private keys were not accessed, customers’ personal information and images tied to government IDs were compromised.

The cybercriminals behind the attack reportedly used the stolen data to carry out social engineering attacks, deceiving customers into sending funds to them. It was determined that insiders bribed by the extortionists were the source of the data breach. Coinbase terminated the individuals involved in stealing the data and took immediate actions to protect customers from the misuse of compromised information.

To prevent further fraud, Coinbase is implementing advanced fraud-monitoring technologies and has pledged to reimburse customers who fell victim to scams related to the breach. Additionally, they are enhancing their security measures and establishing a new support hub in the US. The company anticipates significant costs associated with addressing the cyber incident, estimating a range of $180 million to $400 million.

Despite the financial implications, Coinbase CEO Brian Armstrong responded to the breach with a firm stance against the attackers, emphasizing the commitment to prosecuting and bringing them to justice. Experts have commended Coinbase’s transparent disclosure and aggressive response to the breach, noting that it is a unique approach rarely seen in such situations.

Overall, the breach disclosure by Coinbase and the subsequent actions taken by the company highlight the severity of cyber threats faced by organizations and the importance of robust security measures to protect customer data. The incident serves as a reminder of the ongoing battle against cybercrime and the need for continuous vigilance in safeguarding sensitive information in the digital age.