{"id":24030,"date":"2025-05-15T16:35:02","date_gmt":"2025-05-15T13:35:02","guid":{"rendered":"https:\/\/forklog.com\/en\/coinbase-discloses-data-breach-and-declines-20-million-ransom\/"},"modified":"2025-05-15T16:35:02","modified_gmt":"2025-05-15T13:35:02","slug":"coinbase-discloses-data-breach-and-declines-20-million-ransom","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/coinbase-discloses-data-breach-and-declines-20-million-ransom\/","title":{"rendered":"Coinbase Discloses Data Breach and Declines $20 Million Ransom"},"content":{"rendered":"<p>Coinbase has revealed a breach of user data due to the bribery of overseas support staff. The platform&#8217;s team refused to pay a $20 million ransom and took countermeasures.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on <1% of Coinbase MTUs. No passwords, private keys, or funds were exposed. Prime accounts are untouched. We will reimburse impacted customers. More here: <a href=\"https:\/\/t.co\/SidVn59JCV\">https:\/\/t.co\/SidVn59JCV<\/a><\/p>\n<p>\u2014 Coinbase ?\ufe0f (@coinbase) <a href=\"https:\/\/twitter.com\/coinbase\/status\/1922967576209998133?ref_src=twsrc%5Etfw\">May 15, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The company received an email from a perpetrator claiming to have information on some client accounts as well as internal documents.<\/p>\n<div class=\"wp-block-text-wrappers-update-2 article_update\"><time class=\"gtb_text-wrappers_update_time\">May 15, 2025 | 17:32<\/time><span class=\"gtb_text-wrappers_update_head\">Update: <\/span><\/p>\n<p>Coinbase&#8217;s costs for resolving the incident and compensating clients will range from $180 million to $400 million, according to the company&#8217;s <a href=\"https:\/\/www.sec.gov\/Archives\/edgar\/data\/1679788\/000167978825000094\/coin-20250514.htm?7194ef805fa2d04b0f7e8c9521f97343\">report<\/a> to the <span data-descr=\"U.S. Securities and Exchange Commission\" class=\"old_tooltip\">SEC<\/span> dated May 15.<\/p>\n<p>Some users criticized the company for the delayed acknowledgment of the leak. Wintermute CEO Evgeny Gaevoy <a href=\"https:\/\/x.com\/EvgenyGaevoy\/status\/1922975392928768322\">stated<\/a>:<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>&#8220;This is the dark side of the idiotic and pointless <span data-descr=\"know your customer\/anti-money laundering\" class=\"old_tooltip\">KYC\/AML<\/span> regime we live in. It makes life a bit easier for law enforcement and geopolitical games while sacrificing our privacy, taxing virtually all businesses heavily, and making it easier for criminals to rob, kidnap, and commit crimes.&#8221;<\/em><\/p>\n<\/blockquote>\n<\/div>\n<p>Reports indicate that hackers paid several contractors and employees working in support services outside the U.S. to gather information from internal systems.<\/p>\n<p>As a result, the perpetrators accessed data of &#8220;less than 1%&#8221; of clients, including names, addresses, and emails, according to the trading platform&#8217;s blog. However, passwords, private keys, and user funds were not compromised. Client assets on Coinbase Prime were also unaffected.<\/p>\n<p>The exchange announced compensation for users who sent cryptocurrency to fraudsters as a result of social engineering attacks.<\/p>\n<p>Coinbase has also enhanced security measures:<\/p>\n<ul class=\"wp-block-list\">\n<li>High-risk accounts will undergo additional checks for large withdrawals;<\/li>\n<li>A new support center will be opened in the U.S., with strengthened security controls and monitoring across all divisions;<\/li>\n<li>The company is investing in insider threat detection.<\/li>\n<\/ul>\n<p>Instead of paying the $20 million ransom for silence, Coinbase has created a reward fund of the same amount for those who help identify the perpetrators. The exchange is working with law enforcement, and the dismissed insiders have been handed over to investigators.<\/p>\n<p>Coinbase reminded users that company representatives do not call or ask to transfer funds to &#8220;safe accounts&#8221; or provide 2FA codes.<\/p>\n<p>Back in March, users of the exchange <a href=\"https:\/\/u1f987.com\/en\/news\/phishing-emails-impersonate-coinbase-and-gemini-users-warned\">reported<\/a> phishing emails. Perpetrators, posing as Coinbase, offered to transfer assets to new wallets using pre-generated seed phrases.<\/p>\n<p>In May, on-chain investigator ZachXBT <a href=\"https:\/\/u1f987.com\/en\/news\/fraudsters-steal-45-million-from-coinbase-clients-in-a-week\">reported<\/a> that within a week, perpetrators stole $45 million from users of the trading platform using social engineering methods.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Coinbase has revealed a breach of user data due to the bribery of overseas support staff. The platform&#8217;s team refused to pay a $20 million ransom and took countermeasures. Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on<\/p>\n","protected":false},"author":1,"featured_media":24029,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"","news_style_id":"","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[138,44],"class_list":["post-24030","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-coinbase","tag-cybercrime"],"aioseo_notices":[],"amp_enabled":true,"views":"27","promo_type":"","layout_type":"","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/24030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=24030"}],"version-history":[{"count":0,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/24030\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/24029"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=24030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=24030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=24030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}