Coinbase Arrests Former Indian Employee in Major Data Breach Case

• Coinbase arrested a former Indian employee linked to a major data breach affecting customer information.
• Hackers bribed overseas staff for data and demanded a $20M ransom.
• The investigation is international, with cooperation from law enforcement.

Coinbase has confirmed the arrest of a former customer service employee in India in connection with a major data breach at the company earlier this year. The Hyderabad Police helped with the arrest, which is a step in a case that could cost Coinbase up to $400 million.

Brian Armstrong Praises Indian Police

Coinbase CEO Brian Armstrong disclosed the arrest on social media, publicly thanking Indian law enforcement for their role in the investigation. He stated that the company has zero tolerance for misconduct and will continue working with authorities worldwide to hold those involved accountable.

According to Armstrong, the arrested individual is a former Coinbase support agent, and more arrests are expected as investigations continue.

Hackers Bribed Overseas Agents to Access Customer Data

Hackers bribed Coinbase employees and contractors overseas, mainly in support and outsourcing roles, to steal customer information like names, addresses, and emails. Coinbase said passwords and login keys were safe, so accounts weren’t directly at risk. 

The attackers demanded a $20 million ransom, but Coinbase refused and offered a $20 million reward for information. The total cost of the breach, including damage repair and customer protection, could be between $180 million and $400 million.

Global Law Enforcement Involvement

The arrest in India comes after earlier legal action in the U.S., where the Brooklyn District Attorney charged someone in New York with impersonating Coinbase users. This shows the investigation is international, with Coinbase working with law enforcement in multiple countries. 

Coinbase detected suspicious activity as early as January, months before the hackers contacted them in May, and started investigating before any ransom demand. The attackers targeted support staff in outsourcing operations, using insider access instead of technical hacks.

Notably, the arrest comes soon after Coinbase restarted operations in India after almost two years of regulatory issues. It also happens while Coinbase deals with legal disputes in the U.S. over state regulation of prediction markets. 

Despite these challenges, the company says it is cooperating with regulators and law enforcement to rebuild trust after the major security breach.

Related: Coinbase Sues Michigan, Illinois, and Connecticut Over Prediction Market Oversight Battle