Coinbase Suffers Major Data Breach, Rejects $20M Ransom Demand

Coinbase, the largest US cryptocurrency exchange, suffered a cyber attack in which hackers bribed outsourced support agents to steal sensitive customer data, including names, addresses, masked social security numbers, bank account details, and government ID photos. The attackers demanded a $20 million ransom to prevent releasing the stolen information, but Coinbase refused to pay and instead offered a $20 million reward for information leading to the arrest and conviction of those responsible. The breach affected less than 1% of monthly transacting users, and no login credentials, two-factor authentication codes, private keys, or customer funds were compromised. Coinbase is cooperating with law enforcement, reimbursing customers who were tricked into sending funds, and strengthening security controls. The incident is projected to cost Coinbase between $180 million and $400 million, mainly due to remediation efforts and customer reimbursements. The breach caused Coinbase's stock to drop and occurred just before the company was set to join the S&P 500 index.