Coinbase Confirms Arrest of Former Support Agent in India Over $355 Million Insider Extortion Scheme

Coinbase Global Inc. has confirmed the arrest of a former customer support agent in India as part of an ongoing investigation into a sophisticated insider extortion scheme that targeted nearly 70,000 customers and involved demands for $355 million.

Chief Executive Officer Brian Armstrong announced the arrest on December 27, thanking the Hyderabad Police for their assistance in what he described as a significant breakthrough in the company’s investigation. The arrest marks the first major law enforcement action connected to a data breach that shook the cryptocurrency exchange earlier in 2025.

The scheme, which came to light in May 2025, involved cybercriminals who successfully bribed overseas customer support agents to access sensitive customer data and internal documentation. According to Securities and Exchange Commission filings, Coinbase received an email from an unknown threat actor on May 11, 2025, claiming to have obtained customer account information and demanding money in exchange for not publicly disclosing the stolen data.

Coinbase detailed the mechanics of the attack in a May 15 blog post, revealing that criminals targeted overseas customer support agents with cash offers to convince a small group of insiders to copy data from support tools. The breach affected less than 1% of Coinbase’s monthly transacting users, but the attackers’ goal was to build a comprehensive list of customers to contact while impersonating the exchange.

The stolen information was subsequently used in targeted scams designed to pressure victims into handing over cryptocurrency. The extortion scheme represents one of the most sophisticated insider threats faced by a major cryptocurrency exchange, highlighting the persistent vulnerabilities in the rapidly growing digital asset sector.

Armstrong emphasized the company’s “zero tolerance” stance for insider misconduct and suggested that additional arrests could follow as the investigation continues. The Coinbase CEO’s announcement comes as the cryptocurrency industry grapples with record-breaking security breaches in 2025, with hackers stealing over $2.7 billion in cryptocurrency across various platforms.

The arrest in India underscores the global nature of cryptocurrency-related crimes and the challenges law enforcement faces in pursuing cross-border investigations. Hyderabad has emerged as a significant hub for technology services, including customer support operations for major international companies, making it a focal point for insider threat investigations.

Coinbase stock closed Friday at $236.90, down approximately 1.2% in light holiday trading following the breach disclosure update. Despite the security incident, the exchange has maintained its position as the leading U.S. cryptocurrency platform and has continued aggressive expansion, including the recent acquisition of The Clearing Company to enter prediction markets.

The broader cryptocurrency market has shown resilience despite persistent security challenges. With a total market capitalization of nearly $3 trillion and Bitcoin maintaining dominance at 58.9%, the sector continues to attract institutional investment even as security concerns persist.

This arrest represents a crucial step in addressing insider threats that have plagued the cryptocurrency industry. As exchanges handle increasingly large volumes of digital assets and customer data, the importance of robust internal security measures and international law enforcement cooperation becomes ever more critical for maintaining investor confidence in the digital asset ecosystem.