The $2,500 Bribe That Cost Coinbase $400 Million

In May 2025, hackers bribed Coinbase customer support agents with $2,500 each to steal customer data, leading to a $400 million breach. Coinbase CEO Brian Armstrong refused the $20 million ransom demand and converted it into a bounty for information leading to the hackers' arrest. This is the true crime business documentary of the largest insider attack in cryptocurrency exchange history. The attackers targeted Coinbase's overseas support centers, paying contractors to exfiltrate customer KYC data, government IDs and account details. Less than 1% of Coinbase users were affected but the financial impact was significant. Armstrong's response set a new standard for how crypto exchanges handle ransom demands. Coinbase pledged to reimburse all affected customers and partnered with federal investigators. In December 2025, the first arrest of a former support agent was made in Hyderabad, India. CHAPTERS 0:00 Coinbase Insider Hack May 2025 Explained 1:45 Coinbase Customer Support Bribery Scheme 3:30 The $400 Million Data Breach Financial Impact 5:15 Hackers Demand $20 Million Ransom From Coinbase 6:45 Brian Armstrong Refuses Ransom And Sets $20M Bounty 8:30 The Hyderabad Arrest And Ongoing Investigation ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ FREQUENTLY ASKED QUESTIONS Q: What happened in the Coinbase hack of 2025? A: In May 2025, hackers bribed overseas Coinbase customer support contractors to steal customer KYC data, government IDs and account details. The breach was disclosed in a Coinbase 8-K SEC filing on May 15, 2025. Q: How much did the Coinbase hack cost? A: Coinbase estimated the total cost at $180 million to $400 million, including customer reimbursements, security investments, and legal costs. The hackers had demanded a $20 million ransom. Q: Did Coinbase pay the ransom? A: No. CEO Brian Armstrong refused to pay the $20 million ransom and instead established a $20 million bounty fund for information leading to the hackers' arrest and conviction. Q: How many Coinbase users were affected by the hack? A: Less than 1% of Coinbase's monthly transacting users were affected. Coinbase pledged to make all affected customers whole. Q: Were Coinbase customer funds stolen in the hack? A: No customer cryptocurrency funds or private keys were directly stolen. The hackers obtained personal data including names, addresses, government IDs and account details, which could be used for social engineering attacks. Q: Has anyone been arrested for the Coinbase hack? A: Yes. In December 2025, Coinbase confirmed that a former support agent had been arrested in Hyderabad, India. Brian Armstrong announced the arrest on X. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SOURCES & FURTHER READING Coinbase official blog statement: https://www.coinbase.com/blog/protect... Coinbase 8-K SEC filing: https://www.sec.gov/Archives/edgar/da... Coindesk full coverage: https://www.coindesk.com/business/202... TS2 India arrest update: https://ts2.tech/en/coinbase-data-bre... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ABOUT CRITICAL CHOICE Critical Choice tells the stories behind the biggest corporate scandals, business crimes, and turning point decisions that changed entire industries. Documentary-style storytelling on white collar crime, financial fraud, corporate collapses, and the people behind them. 🔔 Subscribe for new business documentary deep-dives every week. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WATCH NEXT ▶ This Cybersecurity CEO Hacked A Hospital    • This Cybersecurity CEO Hacked A Hospital?   ▶ The Polymarket Bet That Sent A US Soldier To Federal Prison    • He Bet $33,000 On His Own Secret Mission   ▶ The CEO Who Escaped Prison In A Box    • The CEO Who Escaped Prison in a Box   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ #Coinbase #Crypto #TrueCrime