Expected losses to reach up to $400 million
While the financial impact is still being assessed and Coinbase didn't reveal how many customers were deceived into sending funds to the attackers in follow-up social engineering attacks, the company estimates that the resulting expenses will be "within the range of approximately $180 million to $400 million" for remediation and customer reimbursements.
Coinbase added that it will open a new support hub in the U.S., reimburse affected customers tricked into sending funds to the attackers following social engineering attacks, and increase investments in insider‑threat detection, security threat simulation, and automated response to prevent future breach attempts.
The company also advised customers to be suspicious of scammers impersonating Coinbase employees and attempting to trick them into transferring funds or asking them for sensitive information such as passwords or 2FA codes.
If this happens, the crypto exchange recommends hanging up because it never asks for account information over the phone or pressures customers into transferring assets to other wallets. To defend against similar attacks, you should enable two-factor authentication and turn on withdrawal allow‑listing, which ensures secure transfers.
"To the customers affected, we're sorry for the worry and inconvenience this incident caused. We'll keep owning issues when they arise and investing in world‑class defenses—because that's how we protect our customers and keep the crypto economy safe for everyone," Coinbase added.
"Coinbase will voluntarily reimburse retail customers who mistakenly sent funds to the scammer as a direct result of this incident prior to the date of this post, following a review to confirm the facts."
Coinbase's stock soared 24% after the crypto exchange joined the S&P 500, a stock market index that includes 500 leading companies listed on U.S. stock exchanges.
Coinbase data breach exposes customer info and government IDs
Coinbase, a cryptocurrency exchange with over 100 million customers, has disclosed that cybercriminals working with rogue support agents stole customer data and demanded a $20 million ransom not to publish the stolen information.
The company said it would not pay the ransom but would establish a $20 million reward fund for any leads that could help find the attackers who coordinated this attack.
The disclosure comes after the criminals behind the breach emailed Coinbase on May 11, demanding a $20 million ransom to prevent public disclosure of stolen information about certain customer accounts and internal documentation.
Coinbase warns of up to $400 million hit from cyberattack
- "This is a hold-over investigation from the prior administration about a metric we stopped reporting two and a half years ago, which was fully disclosed to the public," Coinbase's chief legal officer, Paul Grewal, said.
No comments:
Post a Comment