Coinbase assured the breach was limited, but the compensation cost could hit $400M.
The SEC was reportedly investigating the exchange for misstated numbers in 2021.
Crypto exchange Coinbase confirmed that a recent security breach affected about 1% of its customers, but assured user funds were safe and those affected would be compensated.
In a statement, the firm blamed ‘rogue overseas support agents’ who collaborated with the alleged cyber criminals to access some user data.
“Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks.”
The criminals reportedly asked for a $20M ransom, but Coinbase declined and formed a $20M bounty hunt for the hackers instead.
Coinbase: Stolen funds, SEC probe
The threat actors accessed contact details including IDs, emails, and phone numbers. They also got account balance data, but didn’t access private keys, hot or cold wallets.
Source: Coinbase
The revelation comes after several complaints of hacks from Coinbase users since early 2025.
In early May alone, renowned Web3 investigator ZachXBT flagged $45M stolen from the exchange.
“Another $45M+ was stolen from Coinbase users via social engineering scams in just the last week. Interestingly, no other major exchange has the same problem.”
ZachXBT stated that the stolen Coinbase funds were about 9 figures for the past four months.
With the customer data, the criminals pretended to be exchange support and tricked them into releasing their crypto. However, the firm assured affected users that they would be refunded.
“We will reimburse customers who were tricked into sending funds to the attacker due to social engineering attacks.”
According to a disclosure filed by the SEC, the exchange liability from affected users could be around $180M-$400M.
The crypto firm debuted on the S&P 500 Index this week, but the milestone has been marred by the hack and another SEC investigation.
According to a New York Times report, the regulator was probing the exchange for falsifying user numbers (claimed 100 million verified users) during the 2021 IPO (initial public offering) preparation.
Collectively, the updates dragged its share, COIN, down 7% on Thursday to $240, erasing some of the gains linked to S&P 500 Index inclusion and broader crypto stocks rally.
Source: COIN, TradingView