India Detains Former Coinbase Support Agent for Data Breach: Armstrong Reports

India Detains Former Coinbase Support Agent for Data Breach: Armstrong Reports

Indian law enforcement has apprehended a former Coinbase customer service representative in Hyderabad concerning a data breach of the cryptocurrency exchange that was revealed earlier this year, as stated by Coinbase CEO Brian Armstrong.

Key Takeaways:

An ex-Coinbase support agent has been arrested in India for a data breach impacting nearly 70,000 users.
Coinbase declined to pay a $20 million ransom, resulting in $307 million in breach-related expenses.
This incident adds to the ongoing legal and security challenges faced by Coinbase.

"We maintain zero tolerance for misconduct and will continue collaborating with law enforcement to hold wrongdoers accountable,” Armstrong mentioned in a tweet on Thursday. “One less to worry about, with more to come.”

Coinbase indicated that the breach, which started in December 2024, was linked to a bribery scheme aimed at offshore customer support employees.

Overview of the Coinbase Data Breach

Cybercriminals reportedly bribed customer service workers to gain access to internal systems, allowing them to extract sensitive information about users, including names, addresses, phone numbers, and government-issued IDs.

Coinbase alerted the Maine Attorney General’s Office that 69,461 users were impacted by this breach.

Following the attack, the criminals demanded a ransom of $20 million, which Coinbase categorically refused. Instead of paying, the company initiated a bounty program offering rewards for information that could assist in arrests and asset recovery.

A detailed investigation by Fortune linked this breach to customer support agents employed by TaskUs, a Texas-based outsourcing firm operating in India.

TaskUs confirmed that two employees were allegedly recruited as part of a wider criminal scheme targeting various service providers for Coinbase support.

Coinbase reported incurred costs of $307 million related to this breach in its second-quarter earnings. These costs cover expenses for remediation efforts and compensations to affected customers.

Additionally, Coinbase is currently facing a class-action lawsuit from shareholders, claiming that the company did not promptly disclose the breach.

The arrest in India followed closely after U.S. prosecutors charged a Brooklyn man with an unrelated phishing scheme that reportedly stole $16 million from around 100 Coinbase users.

Brooklyn Man Indicted for $16 Million Crypto Scam Targeting Coinbase Users

As previously reported, U.S. prosecutors have charged 23-year-old Ronald Spektor from Brooklyn with stealing approximately $16 million in cryptocurrency from around 100 Coinbase customers via an alleged phishing and social engineering ploy.

According to the Brooklyn District Attorney's Office, Spektor deceived victims by impersonating a Coinbase employee. He claimed their funds were at severe risk, pressuring them to move crypto to wallets he controlled.

Authorities revealed that this scheme relied on panic tactics instead of technical hacks. Operating under the pseudonym “lolimfeelingevil,” Spektor allegedly alarmed victims about imminent financial loss, thereby overriding their skepticism and forcing them into hasty decisions.

Once the funds were transferred, prosecutors assert he attempted to obscure their origins by using crypto mixers, engaging in token swaps, and using online gambling sites.

Spektor faces 31 charges, including first-degree grand larceny and money laundering, after a year-long investigation.

Law enforcement has already seized around $105,000 in cash and $400,000 in digital assets, with ongoing efforts to recover more stolen funds.