Coinbase's stock plummeted by over seven percent on Thursday morning after the company disclosed in a regulatory filing a potential loss volume between 180 and 400 million US dollars due to data theft. Affected are less than one percent of monthly active users – according to the company’s own information, up to 97,000 customers.
The leak hit the largest US crypto broker at an extremely unfavorable time: Just a few days before the imminent rise to the S&P 500, it became known that several external support staff outside the US had apparently passed on sensitive customer data to cybercriminals through bribery. This included: Names, addresses, email and phone numbers, ID copies, encrypted bank and social security data, as well as account balances and transaction histories.
Coinbase was informed via email on Sunday about the compromise – including a ransom demand of 20 million US dollars in Bitcoin. The company management responded publicly and decisively: They will not pay. Instead, CEO Brian Armstrong offered a reward of 20 million US dollars for information leading to the capture of the perpetrators.
At the same time, Coinbase has laid off all involved employees, announced criminal charges, and declared that it will voluntarily compensate affected customers who were tricked into transferring to the attackers. Additionally, a new support center is being established in the USA to reduce reliance on third-party providers abroad.
Despite the defensive stance in the acute crisis, Coinbase is under regulatory pressure. The SEC is currently investigating whether past statements about the number of verified users were misleading – a topic that, according to Chief Legal Officer Paul Grewal, was made public more than two years ago and dates back to the previous administration's term.
While Coinbase was previously considered a comparatively safe haven among crypto exchanges, the current incident shows the vulnerability of even established market players to targeted social engineering attacks – and raises the question of whether technological resilience alone is sufficient without organizational depth of control.
