Coinbase 2025: bribed BPO support agents, 69,461 records and a $20 M extortion refusal

What happened

On 15 May 2025 Coinbase, the largest cryptocurrency exchange in the United States, disclosed in a Form 8-K that an unknown threat actor had emailed the company on 11 May claiming to hold information on certain customer accounts and internal documentation, and demanding money in return for not publishing it ^[2]. Coinbase said the actor appeared to have obtained the material by paying contractors or employees in support roles outside the United States to collect records from internal systems they could legitimately reach to do their jobs ^[2]. In a blog post the same day the company described the recruitment as cash offers to a small group of insiders, who copied data from customer support tools for fewer than 1% of Coinbase's monthly transacting users ^[1]. A company spokesperson told TechCrunch that the base for that percentage was 9.7 million monthly customers ^[4].

The fields taken were names, addresses, phone numbers and email addresses; the last four digits of Social Security numbers; masked bank account numbers and some bank identifiers; government-ID images such as driving licences and passports; account balance snapshots and transaction histories; and limited corporate material, including documents, training material and communications available to support agents ^[2]. Coinbase stated that no passwords, private keys or two-factor codes were taken, that at no point could the insiders move customer funds, and that Coinbase Prime accounts were untouched ^[1]. The extortion demand was for $20 million, which the company refused; it instead announced a $20 million reward fund for information leading to the arrest and conviction of the attackers ^[1].

A notice filed with the Maine Attorney General on 21 May 2025 put the number of affected people at 69,461, dated the breach to 26 December 2024 and recorded 11 May 2025 as the date of discovery ^[5][6]. The same filing classified the incident as insider wrongdoing and offered victims one year of credit monitoring from IDX with a $1,000,000 insurance reimbursement policy ^[6]. By Coinbase's own account the aim of the theft was not to break into the exchange but to assemble a contact list that criminals could use while pretending to be Coinbase, in order to talk customers into handing over their crypto ^[1].

The outsourcer involved was TaskUs, a business process outsourcing (BPO) firm headquartered in New Braunfels, Texas, which had supplied customer service staff to Coinbase since 2017 and ran the relevant operation from a service centre in Indore, India ^[7]. TaskUs said it had identified two individuals early in 2025 who illegally accessed a client's information, reported the activity to the client immediately, and believed the pair had been recruited by a much broader, coordinated criminal campaign that also affected other providers serving the same client ^[8]. Coinbase's preliminary estimate of remediation costs and voluntary customer reimbursements was $180 million to $400 million, before potential losses, indemnification claims and recoveries ^[2]. Coinbase shares fell more than 6% in morning trading on the day of disclosure ^[3].

How they got in

There was no exploit and no malware. The criminals used access TaskUs agents already held: Coinbase's filing says the data was collected from internal systems "to which they had access in order to perform their job responsibilities" ^[2]. What the criminals needed was a willing agent, and they bought one with cash offers ^[1].

Reuters, citing five former TaskUs employees, reported that at least one part of the breach came to light when an India-based TaskUs employee was caught photographing her work computer with her personal phone at the Indore centre, and that she and a suspected accomplice were alleged to have been feeding Coinbase customer information to hackers in return for bribes ^[8]. The amended class-action complaint in Estrada v. TaskUs, as summarised by the court, alleges that criminal actors began recruiting TaskUs employees in 2024, paid $200 per photograph of customer records displayed on TaskUs screens, and that the scheme generated about half a million dollars at a site where an entry-level salary ran to roughly $4,000 to $6,000 a year ^[10]. Fortune, citing a source familiar with wages, put TaskUs pay in India at $500 to $700 a month ^[7]. These are pleaded allegations and reported figures, not judicial findings; the court has so far ruled only on whether the claims are adequately stated ^[10].

The complaint describes a hub-and-spoke arrangement in which two employees dealt directly with the criminals and each managed a small circle of other participants who were disconnected from one another ^[10]. Fortune's reporting on the amended complaint names one TaskUs employee, Ashita Mishra, alleges that her thefts began in September 2024, that she sometimes took as many as 200 photographs of customer accounts in a day, and that when TaskUs caught her the phone held data for more than 10,000 Coinbase customers ^[9]. The complaint further alleges that TaskUs policy prohibited personal phones on the floor but that the prohibition was largely not enforced, and that TaskUs lacked keystroke logging that would have shown staff viewing records in bulk ^[10].

Who ran the recruitment is less certain. Fortune exchanged Telegram messages with a person claiming to be one of the hackers, who said the operation was carried out by a loose network of teenagers and twentysomethings known as "the Comm", with one team bribing agents and gathering data while others, coordinating over Telegram and Discord, ran the social-engineering calls and split the proceeds ^[7]. Coinbase did not deny the authenticity of the screenshots that person supplied, but no law-enforcement agency has publicly named the group, so this should be read as a claimed rather than a confirmed attribution ^[7].

How it escalated

A single bribed agent would have been a bounded problem. The escalation came from recruitment inside the centre: according to the complaint, the two organisers drew in further employees, and the scheme extended to team leaders and operations managers ^[10]. TaskUs itself has said it found only two employees who stole customer data, while the complaint alleges that TaskUs could not identify everyone involved because of how far the scheme had spread ^[9][10].

On the Coinbase side, the 8-K states that instances of personnel accessing data "without business need" had been independently detected by the company's security monitoring in the previous months, and that in each case Coinbase terminated the personnel, added heightened fraud-monitoring protections and warned customers whose information might have been viewed ^[2]. What the company did not conclude until the 11 May email arrived was that those instances were part of a single campaign ^[2]. Reuters reported that Coinbase was notified immediately when the Indore employee was caught in January, and that a mass firing followed ^[8]. The Financial Express reported on 11 January 2025 that TaskUs had dismissed over 300 employees in Indore without notice, that staff protested outside the office, and that the terminations were described as being under the pretext of project closure and allegations of fraud ^[18]. TaskUs later told Fortune that 226 staff on the Coinbase account were laid off in January; the complaint puts the figure at 300 ^[7][10].

TaskUs told Fortune that the criminal campaign also hit other providers servicing Coinbase, and a person familiar with the incident said the hackers had targeted other BPOs, in some cases successfully, with the data taken varying by incident ^[7]. In court TaskUs has alleged that Coinbase employees, not only vendor staff, were involved, without elaborating ^[9]. Coinbase has said it cut ties with the TaskUs personnel involved and with other overseas agents, and later that it ended its relationship with TaskUs altogether ^[8][9].

What the attackers did next

The data was put to work in impersonation calls. The court's summary of the complaint describes criminals bombarding customers with calls and texts, posing as Coinbase employees, claiming fraudulent activity had been detected and establishing credibility by reciting the customer's name, phone number, email address and recent transaction history ^[10]. Victims were then talked through creating a new Coinbase wallet, transferring their crypto into it and sharing its details, at which point the attackers took control of the wallet ^[10]. Coinbase's own warning to customers in May described the same script: callers posing as Coinbase staff and pressing customers to move funds to a new address, account, vault or wallet ^[1].

The extortion attempt came last. The 11 May email demanded money in exchange for not publicly disclosing the information ^[2]. Fortune reviewed screenshots of the exchange showing a demand for $20 million in Bitcoin, sent under the name "Lennard Schroeder" and accompanied by taunts aimed at Coinbase's chief executive ^[7]. Coinbase assessed the email as credible, refused to pay, and said it had tagged the attackers' addresses with industry partners so that authorities could track and work to recover assets ^[1][2].

Coinbase's filings do not give a total for funds stolen from customers through the resulting scams ^[13]. The closest proxy is its own reimbursement spend: the annual report for 2025 records $311.2 million of cash paid during the year in connection with the incident, comprising voluntary customer reimbursements and direct legal costs ^[13]. The nine-month 10-Q filed in October 2025 attributes $253.4 million of operating cash outflow specifically to voluntarily reimbursing impacted customers ^[12]. By the third quarter of 2026 the company was reporting the incident net of recoveries, with $43.7 million of net recoveries across the first nine months of 2026 ^[14]. The plaintiffs in Estrada allege that customer losses exceeded $400 million, but that figure is a pleading, not a Coinbase disclosure ^[10].

Detection and response

Measured from the earliest alleged theft to public disclosure, the window is long. The amended complaint dates the first thefts to September 2024 ^[9]; Coinbase's own regulatory notice dates the breach to 26 December 2024 ^[6]; the complaint says TaskUs identified an employee with a personal device at the Indore facility on 1 January 2025 and found hundreds of pictures of customer data and encrypted communications with the criminals ^[10]; and public disclosure came on 15 May 2025 ^[2]. Coinbase's position is that each access anomaly was detected and acted on at the time, and that the May email was what revealed a coordinated campaign ^[2]. Reuters' reporting raised the question of when Coinbase first learned of the incident, since it had been told of the January events immediately ^[8].

Once the campaign was recognised, the response was fast and unusually public. Coinbase emailed every affected customer at 07:20 ET on 15 May, filed the 8-K the same day, and published both the extortion demand and its refusal ^[1][2]. It placed flagged accounts behind additional ID checks on large withdrawals and mandatory scam-awareness prompts, committed to voluntarily reimbursing retail customers who had sent funds to the attacker before the date of the post, and announced a new US-based support hub together with increased investment in insider-threat detection, automated response and adversarial simulation ^[1]. The insiders were dismissed on the spot and referred to US and international law enforcement ^[1].

Law-enforcement outcomes have been slow. In June 2025 Reuters could not determine whether any arrests had been made, and police in Indore did not respond to its enquiry ^[8]. On 26 December 2025 Brian Armstrong said on X that Hyderabad police had arrested a former customer service agent, adding "Another one down and more still to come" ^[16]. Bloomberg reported the arrest the same day ^[21]. It is not public whether any of the $20 million reward has been paid ^[16]. TaskUs told BleepingComputer that the incident involved two individuals and that it had shut down the entire 226-person department ^[17].

What worked: refusing to pay, same-day customer notification and the reimbursement commitment limited second-order damage and gave victims a route to recovery ^[1]. What did not: the months between the first detected anomaly and recognition of a campaign, and a vendor device ban that existed on paper but, by the plaintiffs' account, not in practice ^[2][10].

Impact

Financially, Coinbase's 2025 annual report shows $311.2 million of cash paid for what it calls the Data Theft Incident and a $345.2 million 'platform-related incidents' expense line for the year, within its original range of $180 million to $400 million, made up of voluntary customer reimbursements and direct legal costs ^[13][2]. The nine-month figure to 30 September 2025 was $354.6 million, of which $48.0 million fell in the third quarter ^[12]. The 2026 filings show the line reversing into net recoveries of $18.4 million in the third quarter of 2026 and $43.7 million for the first nine months ^[14]. The company excludes these amounts from Adjusted EBITDA and notes that any reward payments connected with an arrest and conviction would also sit in this line ^[13].

For users, 69,461 individuals were notified, approximately 217 of them Maine residents, with written notices dated 30 May 2025 and one year of IDX credit monitoring, identity restoration and dark-web monitoring ^[6]. The plaintiffs allege the count is an underestimate because some customers who received scam calls did not receive a breach notification ^[10].

Legally, Estrada v. TaskUs was filed in the Southern District of New York on 27 May 2025 and amended on 16 September 2025 to add four further plaintiffs, with TaskUs moving to dismiss on 30 October 2025 ^[11]. On 7 August 2025 the Judicial Panel on Multidistrict Litigation centralised eleven actions pending in four districts, plus further tag-along cases, as In re Coinbase Customer Data Security Breach Litigation in the Southern District of New York; TaskUs opposed inclusion of Estrada in any MDL ^[15]. Coinbase has pushed the customer suits against it towards arbitration ^[9]. On 28 July 2026 Judge Edgardo Ramos granted TaskUs's motion to dismiss in part and denied it in part: conversion, fraud, breach of implied contract and California Consumer Privacy Act claims were dismissed, while negligence, negligent hiring or supervision, unjust enrichment, declaratory relief and unfair and deceptive practices claims survived, with a status conference set for 10 August 2026 ^[10]. TaskUs's 10-Q for the third quarter of 2026 states that it cannot predict the outcome with a reasonable degree of certainty ^[11]. Coinbase's annual report lists continuing exposure to governmental investigations, regulatory scrutiny and ongoing litigation ^[13].

Market effects were contained: the share price fell more than 6% on the morning of disclosure ^[3]. Seven months later, the announcement of the Hyderabad arrest drew criticism on X of the decision to offshore support ^[16].

Root cause

The control that failed was data exposure in the support tier. Agents at an offshore BPO could see complete customer records, including government-ID images, balance snapshots, transaction histories, partial Social Security numbers and bank identifiers, on screen and in volume as a routine part of handling tickets ^[2]. Once that is true, a $200 bribe per screenshot is all an attacker needs ^[10].

Three supporting failures made it worse. First, physical and endpoint control at the vendor: a personal-device ban that, by the plaintiffs' account, was largely unenforced, and no keystroke logging to flag bulk viewing ^[10]. Second, monitoring that caught individual instances of access without business need but did not correlate them into a campaign for several months ^[2]. Third, third-party governance: a vendor relationship dating to 2017 in which the client's visibility of who was on the floor was limited, and in which the vendor, once it looked, could not identify all participants ^[7][10].

Coinbase's own remediation list is the inverse of the failure: a US support hub, stronger security controls and monitoring across all locations, more investment in insider-threat detection and automated response ^[1]. Those are the controls that needed to exist before December 2024 ^[6].

Lessons for Indian firms

The agents who sold the data worked in Indore, the first reported arrest was in Hyderabad, and the client, the contract and the litigation are in the United States ^[8][16][11]. For India's BPO and KPO sector that is the structural lesson: a bribed agent in an Indian delivery centre produced a US securities filing, a US multidistrict class action and a US reputational problem, and the Indian-delivery operator, not the client, is the defendant in Estrada ^[2][15][11]. The arithmetic also matters: a bribe of $200 per image against an entry-level salary that the complaint puts at $4,000 to $6,000 a year is the threat model, and it applies to every Indian centre that handles financial PII ^[10].

The Digital Personal Data Protection Act 2023 changes the domestic exposure ^[19]. Under section 8 a Data Fiduciary remains responsible for processing undertaken on its behalf by a Data Processor, may engage a processor only under a valid contract, must take reasonable security safeguards to prevent a personal data breach, and must intimate the Data Protection Board of India and each affected Data Principal in the event of a breach ^[19]. The Schedule sets penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to give notice ^[19]. An Indian exchange, lender or fintech using a domestic BPO is the fiduciary in that picture, the BPO is the processor, and the contract is the only place where device bans, record-view rate limits, audit rights and bribery-reporting obligations can be made enforceable ^[19].

CERT-In's directions of April 2022 require service providers, intermediaries, data centres and body corporates to report cyber incidents to CERT-In within 6 hours of noticing them, and to keep ICT system logs for a rolling period of 180 days within Indian jurisdiction ^[20]. The months-long gap between the first Indore detections and recognition of a campaign would not sit comfortably with a six-hour clock, and 180 days of support-tool access logs are precisely the evidence an investigation of this kind needs ^[20][2].

Practical steps for Indian operators: enforce device-free floors with physical checks rather than policy statements; mask or tokenise PII in agent consoles so a screenshot is worthless; alert on record views per agent per hour; pitch bribery awareness at the real wage economics of the floor; and run a confidential channel for staff to report approaches. For Indian clients of BPOs: write those requirements into the processor contract, test them on site, and treat vendor floor activity as part of your own detection scope.