Investing.com -- On Thursday, Coinbase (NASDAQ:COIN) disclosed a cyber attack involving the theft of internal data and customer information, with a potential financial impact ranging from $180 million to $400 million.
The company said it refused a $20 million extortion demand and is working with law enforcement to investigate the incident.
The breach, which Coinbase described as an “extortion attempt,” is said to have started when criminals bribed overseas support contractors to extract internal data affecting less than 1% of monthly transacting users.
The attackers reportedly obtained names, addresses, and phone numbers, as well as masked Social Security and bank account information, government ID images, and account data.
Coinbase emphasized that the attackers did not gain access to passwords, two-factor authentication codes, private keys, or customer funds.
“Instead of funding criminal activity, we have investigated the incident, reinforced our controls, and will reimburse customers impacted by this incident,” the company said.
Coinbase said it traced the improper access to individuals hired for support roles outside the United States, whose activity had already triggered internal security alerts in prior months. Those employees were terminated immediately.
Coinbase said it will reimburse any eligible customers who mistakenly sent funds to scammers posing as Coinbase agents and has launched a $20 million reward fund for information leading to the attackers’ arrest and conviction.
To strengthen defenses, Coinbase is opening a new U.S.-based support hub, increasing monitoring of high-risk transactions, and enhancing insider-threat detection.
“Crypto adoption depends on trust,” the company said. “We’ll keep owning issues when they arise and investing in world-class defenses—because that’s how we protect our customers and keep the crypto economy safe for everyone.”
Coinbase shares are down around 2.8% premarket.