Coinbase did not report that hackers stole $400 million in cryptocurrency. After criminals used bribed or recruited support personnel to obtain customer information, the company estimated that remediation and voluntary reimbursements could cost between $180 million and $400 million. Coinbase refused a separate $20 million Bitcoin ransom demand and announced a $20 million reward for information leading to the attackers’ arrest and conviction.
What happened at Coinbase?
Coinbase said it received an extortion email from an unknown threat actor on May 11, 2025. The sender claimed to have customer-account information and internal documentation. Coinbase publicly described the incident on May 15.
According to Coinbase, criminals bribed or recruited a small group of overseas customer-support personnel, who improperly accessed support systems and copied customer information. The disclosed method involved misuse of legitimate access—not a reported exploit that directly compromised Coinbase’s cryptocurrency wallets. The term “insiders” here can include contractors or outsourced support workers; it does not establish that every person involved was a Coinbase employee.
Coinbase said the affected users represented less than 1% of its monthly transacting users. Its public account does not establish one complete list of data types exposed for every affected customer. Claims about particular items such as government identification, bank information, account balances, or Social Security numbers should be checked against the relevant customer notice or official filing, rather than assumed to apply to everyone.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
What does the $400 million figure mean?
In its May 15, 2025 SEC filing, Coinbase gave a preliminary estimate of $180 million to $400 million in remediation costs and voluntary customer reimbursements. The upper figure was an estimate of possible company expenses—not a confirmed amount of cryptocurrency stolen by attackers.
Coinbase warned that the estimate could change as it assessed losses, indemnification claims, and recoveries. The company’s later financial reporting continued to refer to incident-related losses, reimbursements, legal costs, recoveries, and possible reward payments; the sources cited here do not establish a final total. Calling this a “$400 million hack” without explaining the estimate can wrongly suggest that attackers drained $400 million from Coinbase-held assets.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Coinbase also described legal, investigative, and security-response work connected with the incident. Those expenses and potential customer reimbursements help explain why a data breach could carry a substantial cost even without a reported direct theft from Coinbase wallets.
Why are there two separate $20 million figures?
| Figure | What it refers to | What happened |
|---|---|---|
| $20 million in Bitcoin | The attackers’ ransom demand for keeping the stolen information from being published | Coinbase said it refused to pay. |
| $20 million reward fund | A reward for information leading to the attackers’ arrest and conviction | Coinbase announced the fund after refusing the ransom; it was not money paid to the hackers. |
Coinbase said information for the reward could be submitted to [email protected] with “[BOUNTY]” in the subject line. The announcement does not establish that the reward has been paid or that the attackers have been publicly arrested or convicted. A referral to law enforcement and an announced reward are not proof of either outcome.
Recommended Free Tools
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What information was—and was not—exposed?
Coinbase said customer-support information was accessed and copied, and warned that the data could help criminals impersonate the company or its staff. The public disclosure describes the risk and affected-user share, but does not specify a universal inventory of exposed information for each account.
Coinbase said the incident did not expose passwords, login credentials, two-factor-authentication codes, or private keys, and did not give attackers the ability to move customer funds directly. The company also said Coinbase Prime accounts and its hot and cold wallets were unaffected. These are Coinbase’s reported findings about the incident; they do not rule out losses caused later by deception, account-recovery fraud, or other follow-on attacks.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
How stolen customer information can lead to crypto loss
Customer information can make a scam more convincing even when an attacker lacks a password or private key. A criminal may pose as Coinbase support, refer to details that make the contact seem credible, and claim that an account is compromised, frozen, or under investigation. The pressure is meant to make a customer act before checking through an official channel.
- The scammer asks for a password, two-factor code, API credential, seed phrase, or private key—or directs the customer to transfer cryptocurrency to a supposedly safe wallet.
- The customer shares a secret or authorizes the transfer, believing the request is legitimate.
- The scammer uses the credential or authorized transaction to take control of the account or funds.
Coinbase said it would reimburse qualifying retail customers who were tricked into sending funds to attackers as a direct result of this incident. The company said it would review the facts; this was not a blanket guarantee for every scam or every later loss.
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
How Coinbase responded
Coinbase said it fired the personnel involved, referred the matter to U.S. and international law enforcement, and refused the ransom. It also said it tagged attacker-controlled blockchain addresses to support tracing and recovery efforts, and announced the conditional reward for information leading to arrest and conviction.
The company described additional customer and operational measures, including extra identity checks and scam-awareness prompts for flagged accounts and certain large withdrawals. It also said it was increasing investment in insider-threat detection, automated response, and simulated attacks, and opening a new U.S. support hub with additional controls for support operations.
What Coinbase customers should do
- Verify any incident notice. Coinbase said it would notify affected customers. Check for a notice from the official
[email protected]address, but do not rely on an email alone to decide whether a call, text, or message is genuine. - Ignore unsolicited requests for secrets or transfers. Coinbase says it will not ask for your password, two-factor codes, seed phrase, or a transfer to a new address or wallet.
- Do not let a caller take control of your device. Do not install remote-access software at the request of someone claiming to be support.
- Contact Coinbase through its official app or website. Do not use links, phone numbers, or wallet addresses supplied in an unsolicited message.
- Act quickly if you suspect account loss. Use Coinbase’s official account-loss reporting process.
- Take identity-protection steps if identity documents may be involved. Depending on your circumstances, review your credit reports and consider a fraud alert or security freeze.
- Respond to immediate physical-safety concerns. If exposed personal information creates an immediate threat, contact local emergency services.
What remains uncertain
The public sources cited here do not establish Coinbase’s final incident cost, the complete number of affected users, a universal list of exposed data for each person, or whether all downstream losses were recovered. They also do not confirm a reward payout, public arrests, or convictions. Treat those as unresolved unless Coinbase or law enforcement announces a verified update.
The security lesson: legitimate access needs limits and monitoring
This incident illustrates why security controls must address trusted access as well as external attackers. Support staff may need customer records to resolve problems, but broad or poorly monitored access can create a route for data theft if an account is misused or a worker is bribed.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Give support personnel access only to the records and actions needed for their jobs.
- Monitor unusual access patterns, such as large-scale record lookups or activity outside normal work needs.
- Use identity checks and approvals for sensitive support actions, with stronger review for high-risk changes.
- Plan for insider threats and social engineering alongside technical intrusion attempts.
For customers, the practical distinction is that Coinbase reported no direct access to customer funds through this incident, while warning that stolen information could support scams that persuade a customer to authorize a transfer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
