Coinbase Hack Investigation Leads to Arrest of Former Employee

Highlights:

• Coinbase has finally arrested a former employee, linked to a major hack incident on the exchange in May 2025.
• Brian Armstrong confirmed the arrest, adding that more culprits will be arrested and prosecuted.
• The CEO reiterated the company’s commitment to ensuring that customers’ private information and assets are protected.

Months after a major compromise hit Coinbase Global Inc., the U.S.-based exchange announced the arrest of a former customer service representative in India, following internal investigations. Brian Armstrong, Coinbase’s Co-founder and Chief Executive Officer (CEO), confirmed the arrest via a post on his verified X handle. 

In his tweet, the CEO reiterated the company’s zero tolerance for unprofessional conduct. He also noted that Coinbase will continue working with relevant authorities and agencies to ensure that everyone involved in the unprofessional act is prosecuted. 

The CEO stated:

Overview of the Coinbase Hack Incident

The arrest is linked to a serious security breach that occurred in May 2025. Hackers gained access to sensitive customer information by bribing Coinbase employees and contractors based outside the United States. 

The attackers later demanded a $20 million ransom, which the company refused to pay. Coinbase later warned that fixing the damages from the compromise could cost the exchange as much as $400 million, making it one of the highest-profile security incidents in the crypto industry this year.

The trading platform also confirmed that the breach was not a result of a technical system failure. However, insiders were paid to misuse their access to customers’ private information, raising serious concerns about privacy and internal controls, since the affected employees were trusted with sensitive information. 

Future Steps and Plans to Mitigate Recurrence

While Coinbase has not shared full details about everyone involved, Armstrong’s recent statement implies that the investigation is still ongoing. More actions and arrests are likely as authorities in various countries continue to investigate the security compromise. For now, the company’s main priority is to limit the damages caused by the breach. This includes handling the financial impact, protecting its reputation, and reassuring users that their funds are safe. 

Coinbase emphasized that customers’ assets were not stolen. In addition, the company has initiated steps to protect user accounts and data. The exchange also noted that it is tightening its internal security rules. This will include stricter checks on employees and contractors, closer monitoring of customer service operations, and stronger controls to reduce the risk of future recurrence. 

Brooklyn Man Defrauds Coinbase Users of $16 Million

In related news, Crypto2Community reported on December 20 that 23-year-old Brooklyn resident Ronald Spektor scammed over 100 Coinbase users of roughly $16 million by posing as the exchange’s staff. The scammer, disguised as a Coinbase staff member, instills fear in his victims by convincing them that hackers want to steal their valuables. He then instructs them to send their digital assets to his wallet for safekeeping.   

Once he gets custody of victims’ assets, he launders them, using cryptocurrency mixers, gambling sites, and swapping platforms. According to reports, the suspect had openly boasted about his illicit acts in a Telegram group called Blockchain Enemies, where he admitted losing up to $6 million in digital assets to gambling.  He’s now facing 31 charges, including participating in a fraudulent setup, first-degree money laundering, and first-degree larceny.