Coinbase Faces Major Data Breach: Offers $20M Bounty for Hacker Information

Coinbase, a leading cryptocurrency exchange, has disclosed a significant data breach affecting a portion of its customer base. The breach involved unauthorized access to personal information, including names, addresses, phone numbers, and partially masked social security and bank account numbers. Importantly, login credentials, passwords, two-factor authentication codes, and private keys were not compromised. The company estimates that remediation efforts and customer reimbursements could cost between $180 million and $400 million.

The breach was facilitated through social engineering tactics, where cybercriminals bribed certain overseas contractors and support staff to gain access to internal systems. Coinbase responded by immediately terminating the involved personnel and has initiated legal proceedings against them. The company is collaborating with U.S. and international law enforcement agencies to investigate the incident further.

In an attempt to identify and apprehend the perpetrators, Coinbase has declined a $20 million ransom demand and instead is offering the same amount as a bug bounty reward for information leading to the hackers’ arrest. This move underscores the company’s commitment to not negotiating with cybercriminals and to reinforcing its security measures. Coinbase has also pledged to reimburse customers who were deceived into transferring funds to the attackers.

This incident highlights the ongoing security challenges within the cryptocurrency industry, which saw over $2.2 billion stolen through various hacks in 2024 alone. Coinbase’s proactive response, including transparency about the breach and efforts to mitigate its impact, has been noted as a commendable example for other companies facing similar threats. The breach’s disclosure comes just days before Coinbase is set to join the S&P 500 index, marking a significant milestone for the company amid challenging circumstances.