Coinbase, one of the largest cryptocurrency companies in the world, has announced that a recent cyber attack could cost the firm up to $400 million (£301 million).
The company revealed that hackers contacted them, claiming to have accessed customer information by making payments to Coinbase contractors and employees.
In a blog post, Coinbase explained that the criminals accessed less than 1% of customer data. They then used this information to impersonate the company and trick people into handing over their cryptocurrency.
The attackers demanded $20 million from Coinbase to keep the breach secret. However, Coinbase refused to pay and instead promised to reimburse every customer who was scammed.
Following the disclosure, Coinbase’s share price dropped by 4.1%.
The cyber attack occurred just days before Coinbase was set to be included in the S&P 500 index, a significant milestone for the cryptocurrency industry.
This incident highlights how the growing industry is increasingly targeted by cybercriminals.
Research firm Chainalysis reported that cryptocurrency businesses lost a total of $2.2 billion to theft in 2024.
Nick Jones, founder of crypto firm Zumo, said, “Security remains a challenge for the crypto industry despite its growing mainstream acceptance. As our industry expands rapidly, it attracts bad actors who are becoming more sophisticated in their attacks.”
The company received an email from an unknown threat actor on May 11.
Coinbase stated, “We will reimburse customers who were tricked into sending funds to the attacker.”
The company is working closely with law enforcement to ensure the criminals face the strongest penalties. Coinbase confirmed it will not pay the $20 million ransom.
Instead, the company has created a $20 million reward fund for information leading to the arrest and conviction of those responsible.
In a filing with the US Securities and Exchange Commission, Coinbase estimated costs related to the attack will range between $180 million and $400 million. This amount covers remediation expenses and voluntary reimbursements to customers. However, the figure could change depending on potential losses, indemnification claims, and recoveries.
Employees who shared customer information with hackers have been terminated.
Coinbase warned customers to expect further scam attempts and advised them to remain vigilant.
The company emphasized, “Coinbase will never ask for your password, two-factor authentication codes, or request transfers to specific or new addresses, accounts, vaults, or wallets.”
Customers were also advised to lock their accounts if they notice suspicious activity.
Coinbase expressed regret, saying, “To the customers affected, we apologize for the worry and inconvenience caused by this incident. We will continue to take responsibility and address issues as they arise.”
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
