US Justice Department Opens Investigation into Coinbase Data Breach: Report

Highlights:

• DOJ investigates Coinbase breach after bribed contractors stole sensitive customer information.
• Less than 1% of users were impacted, but the $20 million ransom demand raises alarm.
• No money was stolen in the breach, but names, SSNs, and bank details were exposed.

According to a May 19 Bloomberg report, the United States Justice Department (DOJ) is investigating a data breach that Coinbase made public on May 15. The company said some customer support contractors in India, who were later fired, misused their access to steal account information from a small number of customers.

Advertisement

I am a long time investor in and champion of @coinbase. Something that has to be said though – this hack – which includes home addresses and account balances – will lead to people dying. It probably has already. The human cost, denominated in misery, is much larger than the $400m… pic.twitter.com/ruSYKAGH7x

— Michael Arrington 🏴‍☠️ (@arrington) May 19, 2025

Coinbase’s chief legal officer (CLO), Paul Grewal, stated:

“We have notified and are working with the DOJ and other US and international law enforcement agencies and welcome law enforcement’s pursuit of criminal charges against these bad actors.”

Coinbase Data Breach Exposes Users’ Information Without Affecting Wallets or Funds

Coinbase revealed last Thursday that criminals had bribed customer support workers to steal sensitive customer information. The company noted that some personal information was stolen in the breach, including names, contact details, partly hidden Social Security numbers, and bank account information. However, no customer funds, private keys, passwords, or access to wallets were affected. The attackers did not access cold or hot wallets, and Coinbase Prime users remained safe.

Coinbase says that less than 1% of its users were affected by the breach. One of those affected was Roelof Botha, a managing partner at Sequoia Capital, whose personal information was accessed. On May 11, the company received an anonymous email from the hackers demanding a $20 million ransom to keep the stolen data private. The breach may have begun in January. The company fired the customer service staff involved and expects up to $400 million in losses.

https://t.co/evpIBMFvRW pic.twitter.com/f6UPdkL5R0

— Brian Armstrong (@brian_armstrong) May 15, 2025

Before the breach, Coinbase had already noticed unusual activity where some customer support agents outside the US were collecting data from internal systems. The company acted quickly to stop this and prevent further unauthorized access. Although no money was directly stolen in the breach, it exposed risks to customer data and highlighted how social engineering is increasingly used in cyberattacks. Many Coinbase users have since sued the company, claiming it failed to protect their personal information properly.

Coinbase, headquartered in San Francisco, California, enables users to buy, sell, and speculate on cryptocurrency prices. The exchange became public four years ago and is now listed on the Nasdaq with the ticker symbol COIN. 

Binance and Kraken Block Phishing Attacks Like Coinbase Hack: Bloomberg

Hackers are using similar phishing tactics against major crypto exchanges like Binance and Kraken. According to Bloomberg, both platforms recently faced attacks aimed at stealing customer information, similar to the breach at Coinbase. However, Binance and Kraken successfully prevented these breaches by employing robust security measures and advanced AI technology that detected and stopped the threats quickly. Both firms stated, “Our internal artificial intelligence (AI) security system detected and blocked the attack attempts early,” and “No customer information was leaked.”

According to Bloomberg, Binance and Kraken faced social engineering attacks similar to those targeting Coinbase but successfully prevented customer data breaches. Sources report that hackers attempted to bribe Binance customer service staff, directing them to a specific Telegram…

— Wu Blockchain (@WuBlockchain) May 16, 2025

Advertisement