Coinbase Offers $20m Bounty to Take Down Cybercrime Ring Behind Hack

In a bold move against cybercrime, Coinbase, a prominent cryptocurrency exchange, is offering a $20 million reward to anyone who can help identify and bring down the perpetrators of a recent cyber-attack, rather than succumbing to their ransom demands.

Coinbase reported on May 15 that cybercriminals bribed and recruited a group of rogue overseas support agents to steal its customer data and facilitate social engineering attacks.

The attackers planned to use the stolen data to impersonate Coinbase and trick customers into handing over their cryptocurrency holdings.

The US crypto company was asked to pay a $20m ransom to put an end to the scam.

However, Coinbase publicly refused to pay the ransom. Instead, it is working with law enforcement and security industry experts to trace the stolen funds and hold those responsible for the scheme accountable.

The $20m reward fund is part of a ‘Bounty’ program launched by Coinbase. The funds will be awarded to anyone who can provide information leading to the arrest and conviction of the criminals responsible for the attack.

People with relevant information are encouraged to email security@coinbase.com.

Coinbase’s Response to the Cyber-Attack

Coinbase has quickly taken action against the insider perpetrators, firing them immediately and referring them to the US and international law enforcement.

The cryptocurrency exchange will reimburse customers who were tricked into sending funds to the attackers as a result of social engineering attacks.

Furthermore, the company stated that it was implementing additional safeguards, including requiring extra ID checks on large withdrawals from flagged accounts and displaying mandatory scam-awareness prompts.

The company is also bolstering its support operations by opening a new support hub in the US, strengthening security controls and monitoring across all locations.

It is also hardening its defenses by increasing investment in insider-threat detection and automated response, as well as simulating similar security threats to identify potential vulnerabilities.

Coinbase is also collaborating with law enforcement and the private sector to identify the attackers’ addresses, enabling authorities to track and potentially recover the stolen assets.

Finally, Coinbase intends to press criminal charges against those who carried out the cyber-attack.

Data Breach Impact

According to Coinbase, the hackers managed to get the following customer data:

• Name, address, phone, and email
• Masked Social Security (last four digits only)
• Masked bank‑account numbers and some bank account identifiers 
• Government‑ID images (e.g., driver’s license, passport)
• Account data (balance snapshots and transaction history)
• Limited corporate data (including documents, training material, and communications available to support agents)

However, the company assured that no passwords, private keys, two-factor authentication (2FA) data or funds were exposed. Additionally, the attackers have not been able to access or move customer funds, including hot and cold cryptocurrency wallets. Moreover, Coinbase confirmed that its Coinbase Prime accounts remained entirely unaffected by the breach.

The data breach affected less than 1% of Coinbase’s monthly transacting users.

Coinbase has preliminarily estimated expenses to be within the range of approximately $180 million to $400 million relating to remediation costs and voluntary customer reimbursements relating to this Incident, according to its filing with the US Securities and Exchange Commission.

Photo credits: Nadezda Murmakova/JOCA_PH/Shutterstock