Loading story…
A former Coinbase customer service agent was arrested in Hyderabad, India, for assisting hackers in stealing sensitive customer data from the cryptocurrency exchange. The breach, which occurred earlier in the year, involved hackers bribing employees of TaskUs, a customer support outsourcing firm, to gain unauthorized access to Coinbase's systems. The attackers demanded a $20 million ransom to prevent the publication of the stolen data, which included names, dates of birth, partial Social Security numbers, addresses, phone numbers, email addresses, and, for some, scanned KYC documents. Coinbase reported that approximately 69,500 customers were affected by the breach, and the company responded by shutting down the implicated TaskUs department and cooperating with law enforcement.
The arrest of the former agent highlights the ongoing risk of insider threats within organizations, particularly those handling sensitive financial data. Coinbase CEO Brian Armstrong confirmed the arrest and indicated that further detentions may follow as the investigation continues. The incident also drew attention to the delayed disclosure of the breach and the subsequent layoffs at TaskUs. This case underscores the importance of robust insider threat detection and the risks associated with third-party service providers in the financial sector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
By the end of December, reporting indicated that new arrests had been made in connection with the Coinbase insider data scandal. The developments suggested the law-enforcement investigation had expanded beyond the first arrested former support agent.
In an unrelated case, the Brooklyn District Attorney's Office charged Ronald Spektor with impersonating a Coinbase representative to steal nearly $16 million from about 100 victims. Coinbase said it assisted the investigation, and authorities recovered over $600,000.
Following the discovery of the insider-assisted breach, an entire TaskUs department was shut down and several employees of the outsourcing firm were laid off. The response underscored the role of third-party support operations in the incident.
Coinbase declined to pay the extortion demand and instead created a $20 million reward fund for information leading to the attackers' arrest. The company publicly framed the incident as an insider-assisted breach involving overseas support staff.
Indian police arrested a former Coinbase customer service agent accused of helping hackers steal customer data from Coinbase's systems. Coinbase CEO Brian Armstrong confirmed the arrest and said additional arrests are expected.
After obtaining the customer data, the attackers demanded $20 million from Coinbase in exchange for not publishing it. Criminals also used the stolen information to conduct social engineering attacks against Coinbase users.
Hackers bribed customer service representatives or contractors working through outsourcing firm TaskUs to access Coinbase customer information. The insider access exposed sensitive data for about 69,500 customers, including personal and KYC-related details, but not private keys or 2FA codes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coinbase confirmed an **insider data breach** in which a single contractor improperly accessed customer information affecting approximately **30 customers**. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and **identity theft protection** was offered; Coinbase also reported the incident to relevant regulators. The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal **Coinbase support interface** that appeared to expose access to sensitive customer data, including **names, email addresses, phone numbers, dates of birth, and KYC information** (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is **separate from the previously disclosed TaskUs-related insider breach**, and it remains unclear whether the group that posted the screenshots (reported as **“Scattered Lapsus Hunters”**) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of **BPO/contractor ecosystems** due to their privileged access to internal tools and customer records.
Jun 29, 2026
A security researcher, Jonathan Clark, has publicly challenged Coinbase's official timeline regarding a major data breach that exposed sensitive information of nearly 70,000 customers. Clark claims he was targeted by scammers on January 7, 2025, who possessed detailed personal and financial information that should have only been accessible through Coinbase, including his Social Security number and exact Bitcoin balance. He immediately reported the incident to Coinbase, receiving an initial acknowledgment from the company's Head of Trust & Safety, but received no further response despite multiple follow-ups. Coinbase later disclosed to the US Securities and Exchange Commission in May 2025 that the breach occurred on December 26, 2024, but was not discovered until May 11, 2025, when attackers attempted to extort the company for $20 million. Clark disputes this timeline, providing emails and call records as evidence that the breach was known to Coinbase months before their public disclosure. The incident raises serious questions about Coinbase's breach notification practices and the security of customer data.
Jul 12, 2026
Cybercriminals are increasingly targeting employees within banks, telecommunications companies, and technology firms, offering substantial payments in exchange for insider access to sensitive systems and data. Recent research by Check Point highlights that these recruitment efforts are conducted via darknet forums, with payouts ranging from $3,000 to $15,000 for one-time access or specific information, and even higher for particularly valuable data such as large cryptocurrency exchange records. The campaigns specifically name high-profile organizations, including major banks, cryptocurrency exchanges like Coinbase and Binance, and tech giants such as Apple and Samsung, as well as cloud service providers and consulting firms. Insiders are being solicited to provide network access, leak credentials, disable security defenses, or facilitate attacks such as SIM-swapping, which can be used to bypass two-factor authentication. The recruitment tactics often employ emotional manipulation, promising financial freedom and long-term arrangements, with some offers including weekly payments for ongoing cooperation. The financial sector remains a primary target due to the direct access to funds and customer data, but the threat extends to other industries, including telecommunications and technology, where employees can enable attacks on infrastructure and user accounts. These developments present a significant security challenge, as insider threats are more difficult to detect and mitigate compared to external attacks, and highlight the need for organizations to strengthen internal monitoring and employee awareness programs.
Jun 29, 2026