Cryptocurrency exchange Coinbase (NASDAQ:COIN) revealed it could incur losses between $180 million and $400 million due to a recent cyberattack that compromised account information for a portion of its user base. The news sent the company’s stock down roughly 3% in Thursday’s premarket trading.
According to the company, it received a message from an unidentified threat actor on May 11, who claimed to possess sensitive data related to customer accounts and internal documentation. Coinbase acknowledged the breach, noting that while login credentials and passwords were not compromised, attackers were able to access personal details such as names, email addresses, and physical addresses.
The attack comes just as Coinbase prepares to join the S&P 500 index—an important milestone for the broader crypto sector.
Although the company has not disclosed the exact number of affected users, it confirmed that the attackers deceived some individuals into transferring funds. Coinbase pledged to fully reimburse customers who suffered financial losses as a result.
The company traced the data breach to contractors and support staff based outside the U.S., who were allegedly paid by the hackers to extract information from internal systems. Those implicated were immediately terminated, Coinbase said.
The hackers reportedly demanded a $20 million ransom, which Coinbase refused to pay. Instead, the company has offered a $20 million reward for credible information that leads to the identification and capture of those responsible.
“Rather than supporting criminal behavior, we chose to strengthen our internal defenses, cooperate with law enforcement, and compensate our impacted users,” Coinbase stated in an official blog post.
Security breaches remain a persistent concern for the digital asset space. Earlier this year, rival platform Bybit reported the theft of crypto assets valued at approximately $1.5 billion – described by many as the largest heist in the sector’s history.
According to blockchain analytics firm Chainalysis, hackers stole an estimated $2.2 billion from crypto platforms in 2024 alone, marking the fourth consecutive year in which annual thefts exceeded the $1 billion mark.
As Coinbase strengthens its security framework in response, the incident underscores the ongoing vulnerabilities in the crypto ecosystem—even among its most prominent players.