Coinbase Data Breach: Brian Armstrong Offers $20 Million Bounty for Intel on Attackers

Coinbase CEO Brian Armstrong has publicly responded to cyber attackers who attempted to blackmail the cryptocurrency exchange and extort it of $20 million.

Armstrong’s latest post on X has a 2-minute 44-second video of him rejecting the attackers’ bargain and offering an equivalent reward to anyone with information leading to their arrest and conviction.

https://t.co/evpIBMFvRW pic.twitter.com/f6UPdkL5R0

— Brian Armstrong (@brian_armstrong) May 15, 2025

Attackers Demanded Bitcoin Ransom After Limited Data Breach

According to Armstrong, the attackers sent Coinbase an email demanding a $20 million ransom in Bitcoin. They claimed paying the ransom would be the only way to stop them from releasing users’ information they had illegally obtained.

Highlighting Coinbase’s model of transparent operation, Armstrong addressed the issue publicly, emphasizing the crypto exchange’s decision not to pay ransom. The Coinbase CEO outlined the company’s proactive approach, noting the immediate steps taken to investigate the issue and neutralize the attackers’ threats.

Breach Involved Overseas Support Agents, Limited User Data Exposed

Coinbase’s internal investigation into the security situation discovered that the attackers gained access to less than 1% of users’ data with the help of one or more overseas support agents.

According to Armstrong, the cybercriminals sought a weak link among the overseas agents, someone who would accept a bribe in exchange for sharing some customer information.

Despite the breach, Armstrong downplayed the security impact by highlighting the limited information support agents can access on the Coinbase platform. He assured the public that the attackers did not obtain critical data like passwords or private keys. They could only retrieve less critical information like names, addresses, and users’ dates of birth.

Coinbase Pledges Reimbursement, Security Upgrades, $20M Bounty

Meanwhile, Armstrong cited the attackers’ potential to use the retrieved information to conduct social engineering attacks in a secondary heist. He regretted the actions of the “few bad apples” within the Coinbase global workforce but promised to reimburse customers who fell victim to social engineering because of the incident.

Armstrong informed the public about Coinbase’s effort to improve its security and prevent a repeat of such breaches, including relocating some of its customer support operations. Instead of paying a ransom, Coinbase has issued a $20 million reward for information that would lead to the arrest and conviction of the attackers.

Source