Coinbase expects up to US$400 million U.S. hit from cyber attack

The mobile phone icon for the Coinbase app is shown in this photo, in New York, Tuesday, April 13, 2021. (AP Photo/Richard Drew)

Coinbase forecast a hit between US$180 million and $400 million from a cyber attack that breached account data of a “small subset” of its customers, sending the crypto exchange’s shares down three per cent in premarket trading on Thursday.

The company said it received an email from an unknown threat actor on May 11, claiming to have information about certain customer accounts as well as internal documents.

While some data including names, addresses and emails was stolen, the hackers did not get access to login credentials or passwords, Coinbase said. It will, however, reimburse customers who were tricked into sending funds to the attackers.

The disclosure comes days before the company is set to join the benchmark S&P 500 index, marking a landmark moment for the crypto industry.

• S&P 500 market updates here

Coinbase said hackers had paid multiple contractors and employees working in support roles outside the U.S. to collect information. It has fired those involved.

“This may push the industry to adopt stricter employee vetting and introduce some reputational risks,” said Bo Pei, analyst at U.S. Tiger Securities.

Security remains a challenge for the crypto industry despite its growing mainstream acceptance. In February, Bybit disclosed a hack in which around $1.5 billion of digital tokens were stolen — widely dubbed the biggest crypto heist of all time.

Funds stolen by hacking crypto platforms totalled $2.2 billion in 2024, according to a report from Chainalysis.

“As our nascent industry grows rapidly, it draws the eye of bad actors, who are becoming increasingly sophisticated in the scope of their attacks,” said Nick Jones, founder of crypto firm Zumo.

Coinbase has refused to pay a ransom demand of $20 million from the attackers and is working with law enforcement agencies. It has instead established a $20 million reward for information on the hackers.

The company is also opening a new support hub in the U.S., and taking other measures to prevent such cyberattacks, it said.

Reporting by Niket Nishant and Pritam Biswas in Bengaluru; Editing by Shinjini Ganguli, Reuters