In one of the most unsettling cyber incidents in recent crypto history, Coinbase, the largest U.S.-based cryptocurrency exchange, revealed a breach that wasn’t caused by sophisticated malware or zero-day exploits, but by something far older and more dangerous: human manipulation.
On May 15, 2025, Coinbase publicly disclosed that a small group of overseas customer support agents had been bribed by cybercriminals to leak customer data, leading to a failed $20 million extortion attempt and a significant social engineering campaign against users.
What Happened?
This breach wasn’t your typical smash-and-grab attack. It was an inside job orchestrated through cash bribes, where criminals convinced a few rogue Coinbase support agents (based overseas) to abuse their access.
Using support tool permissions, the insiders exfiltrated sensitive customer data from less than 1% of Coinbase’s monthly transacting users, roughly equating to ~97,000 people.
What Was Exposed?
While no funds were directly stolen from user wallets, the following PII and account data was compromised:
- Full name, email, phone number, and home address
- Last 4 digits of Social Security numbers (masked)
- Masked bank account details and identifiers
- Government-issued ID images (e.g., passport, driver’s license)
- Balance snapshots and transaction history
- Internal documents, training materials, and communication metadata
Crucially, passwords, 2FA codes, private keys, and wallet access credentials were not breached.
But the damage had already been done. Attackers used this trove of data to launch realistic phishing and social engineering campaigns, posing as Coinbase support to trick users into voluntarily transferring funds.
The Aftermath
The attackers tried to extort Coinbase for $20 million, threatening to release the stolen data and tarnish the exchange’s reputation. Coinbase refused to comply and instead:
- Fired all involved insiders
- Informed law enforcement and initiated criminal proceedings
- Created a $20 million bounty for any information leading to the arrest and conviction of the attackers
- Reimbursed users who were deceived into sending funds due to the scam
- Strengthened internal controls, especially in overseas support hubs
How Users Can Stay Safe (Even When Systems Fail)
Even the most secure systems can’t protect against you voluntarily giving your funds away.
Here’s how users can harden their own security posture:
1. Enable 2FA and use a hardware key
SMS-based 2FA is better than nothing, but it’s still vulnerable to SIM swapping and phishing. Instead, use hardware-based 2FA (like Yubikeys) to secure your login.
2. Turn on withdrawal allow-listing
This feature allows funds to be transferred only to pre-approved wallet addresses. Even if an attacker gains access, they can’t reroute your crypto without your knowledge.
3. Never trust unsolicited messages or calls
Coinbase (and other exchanges) will never ask for:
- Your password or 2FA code
- Access to your wallet or seed phrase
- That you move your funds to a “safe wallet”
If anyone makes such a request, it’s a scam.
4. Hang up on imposters
If you receive a call claiming to be from Coinbase support, end it. Contact support directly via the app or website. Never respond to numbers sent via email or text.
5. Educate yourself about phishing and social engineering
Knowledge is your best defense. Read articles, take training, and follow security updates from trusted sources. Awareness can prevent financial ruin.
6. Use PulseCheck by Resonance
At Resonance, we’ve built PulseCheck - a free tool that helps you assess your security posture in minutes. It checks for vulnerabilities in your digital habits, flagging weak spots before attackers exploit them.
Resonance Security’s Take
At Resonance, we see this for what it truly is: a sobering reminder that most attacks don’t break systems, they exploit people.
As the crypto industry matures, the threat landscape has evolved. Hackers no longer rely only on brute-force techniques or exploits. They exploit the weakest links in the chain, like underpaid employees, overworked agents, and overloaded users.
The Coinbase case is a classic insider threat scenario combined with social engineering, two of the hardest attack types to detect in real time. And with customer trust on the line, even a “limited breach” can carry massive reputational risk.
In one of the most unsettling cyber incidents in recent crypto history, Coinbase, the largest U.S.-based cryptocurrency exchange, revealed a breach that wasn’t caused by sophisticated malware or zero-day exploits, but by something far older and more dangerous: human manipulation.
Closing Thoughts
Coinbase handled this breach with refreshing transparency and maturity. They didn’t sweep it under the rug, didn’t blame a “sophisticated cyberattack,” and didn’t pay the ransom. They took responsibility, reimbursed affected users, and strengthened their defenses.
But the fact remains: Insider threats and social engineering are on the rise. The only way forward is to combine technical safeguards with cultural resilience and user awareness.
As we build the next generation of Web3 infrastructure, let this incident serve as a crucial reminder: Security isn’t just code. It’s people, processes, and preparedness. Stay alert. Stay informed. And never hand over your crypto, even if it “looks like” Coinbase on the other end.
If you’ve faced a cyberattack or want to ensure you never do, Resonance Security is here to help. Book your FREE consultation today and take the first step toward bulletproof protection.
.png)