TLDR

Table of Contents

US Department of Justice has opened an investigation into a recent cyberattack at Coinbase
Threat actors stole customer data including names, addresses, and emails, but not login credentials or passwords
Coinbase expects financial losses between $180-400 million from the breach
The company rejected a $20 million ransom demand and instead created a $20 million reward fund for information leading to arrests
The attack involved bribing employees and contractors in India to gain access to sensitive client data

Cryptocurrency exchange Coinbase is now working with the US Department of Justice (DOJ) as authorities investigate a major cybersecurity breach that compromised customer data. The attack, which came to light on May 11, has raised concerns about data security in the crypto sector and could cost the company up to $400 million.

The company confirmed on Monday that the DOJ has opened a probe into the security incident. “We have notified and are working with the DOJ and other US and international law enforcement agencies and welcome law enforcement’s pursuit of criminal charges against these bad actors,” said Paul Grewal, Chief Legal Officer at Coinbase.
A source close to the matter clarified that “Coinbase is not under DOJ investigation, DOJ is investigating the criminal actors.” The DOJ’s criminal division in Washington is examining the circumstances surrounding the breach.

How The Attack Happened

The breach involved criminal actors bribing employees and contractors based in India to gain access to sensitive client information. The attackers managed to steal various customer data, including names, addresses, and email addresses.

Coinbase has reassured users that the attackers did not gain access to login credentials or passwords. This limitation may help minimize the direct impact on customer accounts, though the exposure of personal information still poses risks.

The company first became aware of the issue when it received an email from an unknown threat actor on May 11. The message claimed the attackers had obtained information about certain customer accounts as well as internal company documents.

The financial impact of the cyberattack is expected to be substantial. Coinbase has estimated losses ranging from $180 million to $400 million as a result of the incident.

Rejecting Ransom Demands

In a bold move, Coinbase publicly refused to meet the attackers’ ransom demands. The criminals had requested a payment of $20 million in exchange for not releasing the stolen data.

Instead of paying the ransom, Coinbase announced on May 15 that it would establish a $20 million reward fund. This fund is designed to encourage information that leads to the arrest and conviction of those responsible for the attack.

We will pursue the harshest penalties possible and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.
— Coinbase 🛡️ (@coinbase) May 15, 2025

The decision to reject the ransom demand and instead offer the same amount as a bounty reflects a strategic approach to dealing with cyber extortion. By redirecting the funds toward catching the perpetrators, Coinbase aims to discourage future attacks.

The company shared this update with users via its social media accounts, seeking to maintain transparency throughout the incident response process.

Despite the security breach, Coinbase’s stock (COIN) showed resilience in the market. At the close of trading on Monday, the company’s shares were trading at $263, indicating that investors may not view the incident as severely impacting the company’s long-term outlook.

The DOJ has not yet issued an official statement regarding the investigation. As the probe continues, Coinbase is working to strengthen its security measures and prevent similar incidents in the future.

The breach at Coinbase comes at a time when cryptocurrency platforms face growing threats from sophisticated threat actors. As the world’s largest cryptocurrency exchange, Coinbase’s security practices are under particular scrutiny.

The attack highlights the evolving tactics used by cybercriminals, who are increasingly targeting employees through bribery and social engineering rather than relying solely on technical vulnerabilities.

Law enforcement agencies from multiple countries are now involved in tracking down the perpetrators, making this an international investigation.

Coinbase continues to monitor for any misuse of the stolen information and has promised to keep customers informed as the situation develops.

Stay Ahead of the Market with Benzinga Pro!

Want to trade like a pro? Benzinga Pro gives you the edge you need in today's fast-paced markets. Get real-time news, exclusive insights, and powerful tools trusted by professional traders: