Coinbase said a former customer support agent was arrested in India as investigators probe a breach tied to insider bribery and customer data theft.
Chief Executive Officer Brian Armstrong said on Dec. 27 that the arrest involved a former support agent and thanked Hyderabad Police for assistance in the ongoing investigation.
The update puts attention on the operational side of exchange security, including who can access support tooling, how exceptions are handled, and how outsourced teams are supervised.
We have zero tolerance for bad behavior and will continue to work with law enforcement to bring bad actors to justice. Thanks to the Hyderabad Police in India, an ex-Coinbase customer service agent was just arrested. Another one down and more still to come.
Those areas can shape regulatory expectations and risk pricing in 2026
Coinbase has described the incident to regulators as an extortion attempt built on insider access.
In a May 14 filing, the company said it received an email demanding payment and claiming the sender had obtained customer information and internal documents, according to the SEC.
Coinbase said the information was taken from systems used for customer support and account management.
The company added that the stolen data was used to conduct social engineering attempts against customers.
Public filings provide a timeline and a specific headcount.
A state notification filed in Maine listed the breach date as Dec. 26, 2024, with insider wrongdoing discovered May 11, 2025, and reported 69,461 affected people, according to the Maine Attorney General’s office.
Reuters has also reported that the U.S. Department of Justice opened an investigation into the incident earlier in 2025, adding federal scrutiny to the company’s response and controls.
The company has tied the event to remediation work and reimbursements for customers who lost funds after being targeted.
Coverage of Coinbase’s disclosure referenced a company estimate of $180 million to $400 million in costs tied to remediation and voluntary reimbursements.
Coinbase’s Q3 2025 shareholder letter recorded $48 million in “data theft incident” costs in Q3 after $307 million in Q2, for $355 million recognized across the two quarters.
The $355 million total equals about 89% of the $400 million top end of that range, a datapoint investors have used to gauge how much of the guided amount has already flowed through earnings.
| Timeline and cost checkpoints | Detail |
|---|---|
| Breach date | Dec. 26, 2024 |
| Insider wrongdoing discovered | May 11, 2025 |
| SEC material incident filing | May 14, 2025 |
| Affected people | 69,461 |
| Company cost estimate | $180 million–$400 million |
| Costs recognized in earnings | $307 million (Q2 2025) + $48 million (Q3 2025) = $355 million |
The mechanism described in the SEC filing shifts attention from custody technology toward identity, access, and human workflows.
Coinbase said support personnel were bribed or recruited to access internal tooling and pull customer information, creating conditions for impersonation attempts and account takeovers.
Even when private keys and on-chain infrastructure are not directly compromised, a compromised support channel can function as a distribution point for fraud.
Victims may treat inbound calls, emails, or chat messages as authentic when they appear to come from an exchange.
Breach research outside crypto is converging on the same exposure: third parties
Verizon’s 2025 Data Breach Investigations Report said third-party involvement in breaches doubled to 30% globally.
For exchanges that rely on contractors and outsourced teams, the operational answer is measurable controls around access scope and oversight.
That includes least-privilege design, session monitoring, privileged access reviews, and stronger out-of-band verification for high-risk account changes.
The incident also fits into a 2025 crime mix where theft and scams scale through social engineering.
Chainalysis reported more than $2.17 billion stolen in the first half of 2025 and said the pace could reach as much as $4 billion for the year.
In the Coinbase case, the SEC filing lays out a repeatable sequence: data taken from internal systems, a plausible impersonation surface, then targeted outreach to users.
U.S. prosecutors have described how that sequence plays out at the victim level.
The Brooklyn District Attorney’s Office said a 23-year-old was indicted in a phishing and social engineering scheme that stole nearly $16 million from about 100 Coinbase users.
Prosecutors described impersonation of Coinbase representatives and laundering through swaps, mixers, and gambling services.
Coinbase separately wrote that it worked with the Brooklyn DA in that matter as part of supporting victims and assisting prosecutors, according to Coinbase.
Regulatory frameworks in Europe and the U.K.
EU rules under the Digital Operational Resilience Act emphasize ICT risk controls and oversight of contracted providers, including dependency management for critical services, according to Baker McKenzie.
In the U.K., the Financial Conduct Authority’s consultation work on how handbook requirements apply to regulated cryptoasset activities discusses operational and technology risks and resilience expectations, according to Regulation Tomorrow.
For market participants holding liquid tokens rather than exchange equity, the immediate transmission channel is behavior around custody and access to fiat rails.
Incidents rooted in impersonation and account access can push users to split balances across venues and move more assets into self-custody.
That can thin order books at the margin for less liquid assets and shift where retail volume routes.
Coinbase’s Q3 2025 shareholder letter said operating expenses increased in part due to customer service and global compliance efforts, positioning fraud prevention and support operations as recurring cost centers rather than episodic work.
Armstrong said Coinbase is continuing to work with law enforcement, including Brooklyn District Attorney’s Office.
The post Coinbase claims arrest in the $355 million insider extortion scheme that targeted nearly 70,000 customers appeared first on CryptoSlate.