Coinbase, the largest U.S.-based cryptocurrency exchange, said Thursday that cybercriminals stole personal data from customers and demanded a US$20-million ransom to avoid releasing the information publicly.
CEO Brian Armstrong said in a social media post that some of the company’s customer service agents outside the U.S. were bribed into handing over data such as names, dates of birth and partial Social Security numbers.
“The stolen data allows them to conduct social engineering attacks where they can call our customers impersonating Coinbase customer support and try to trick them into sending their funds to the attackers,” Armstrong said.
Social engineering is a common hacking tactic that exploits human vulnerabilities. Many major companies have suffered data breaches due to such scams in recent years.
Coinbase did not disclose how many customers were affected or whether any fell victim to scams, but it pledged to reimburse anyone who did.
Coinbase shares fell 6% by midday Thursday. Despite the drop, the stock remains up about 22% this month due to gains in bitcoin and other cryptocurrencies.
In a filing with the U.S. Securities and Exchange Commission, Coinbase estimated it would spend between US$180 million and US$400 million on remediation efforts and voluntary reimbursements to affected customers.
The filing also revealed that, “in previous months,” the company had detected some customer service agents “accessing data without business need.” Those employees were terminated, and Coinbase said it has increased its fraud prevention efforts.
The company said it received an email from the attackers on Sunday, demanding US$20 million worth of bitcoin to avoid the public release of stolen customer data.
Armstrong said Coinbase would not pay the ransom but instead is offering a US$20-million bounty for information leading to the attackers’ arrest.
“For these would-be extortionists or anyone seeking to harm Coinbase customers, know that we will prosecute you and bring you to justice,” Armstrong said. “And know you have my answer.”