Thieves recently stole Coinbase customers’ personal information and tried to extort it for $20 million, the company announced Thursday.
Coinbase, the United States’ largest cryptocurrency exchange, said that instead of paying, it is offering a $20 million bounty for information leading to the arrest of those responsible.
In a Wednesday evening filing with the Securities and Exchange Commission, Coinbase said that it received an extortion email on Sunday from criminals who had obtained some users’ names, addresses, contact information, government identification, transaction history and the last four digits of their Social Security numbers.
The criminals gained the information by paying overseas contractors and support workers to hand it over, Coinbase said.
Cryptocurrency exchanges are top targets for hackers and other cybercriminals, as bitcoin and other cryptocurrencies work outside of traditional banking systems and are often difficult to retrieve if stolen. Coinbase had largely avoided major cyber incidents until now.
The company declined to say how much customer information was accessed, though in a video addressing the scam posted to X, Coinbase CEO Brian Armstrong said it was fewer than 1% of the company’s monthly active users.
Armstrong indicated that at least some Coinbase customers were successfully tricked out of their funds by scammers using the stolen information to pretend to be customer support, noting that such customers would be reimbursed.
It’s unclear how much money the criminals stole from users, but the SEC filing said the company’s combined losses from remediation and reimbursements would be $180 million to $400 million.
In an email sent Thursday morning to customers who were affected, a copy of which was obtained by NBC News, Coinbase said it would never directly ask customers for their login information or call them and instruct them to transfer assets.
“To the customers affected, we’re sorry for the worry and inconvenience this incident caused,” it said.
In his X message, Armstrong said the company was actively pushing for the criminals to be identified and arrested.
“For these would-be extortionists or anyone seeking to harm Coinbase customers, know that we will prosecute you and bring you to justice,” Armstrong said.
