In May 2025, Coinbase disclosed that cyber criminals had bribed a small group of overseas customer-support contractors to hand over sensitive account information. The company said it rejected a $20 million ransom demand and instead went public, a decision that drew both praise for transparency and criticism over how the data was exposed in the first place.
Coinbase warned the incident could cost between $180 million and $400 million in remediation and customer reimbursement. The exchange later confirmed the breach affected at least 69,000 customers, and reporting linked part of the leak to employees of an outsourcing contractor in India.
Why it matters
The episode is a reminder that the biggest risk to a regulated exchange is not always a smart-contract exploit but the people with legitimate access to systems. For a company that joined the S&P 500 the same week, the breach underlined how operational and vendor risk now sits at the centre of crypto's credibility problem.
The hardest part of custody is not the cryptography. It is trusting the humans who sit next to it.
Coinbase said it would reimburse customers who were tricked into sending funds as a result of the social-engineering campaign, and pledged to open a new US-based support hub and tighten insider controls.