TLDR:
- Hackers bribed external contractors to steal customer data and demanded $20 million ransom from Coinbase.
- The breach could cost Coinbase up to $400 million in remediation expenses and security system upgrades.
- Hyderabad Police arrested the former customer service agent after collaboration with Coinbase investigators.
- Brooklyn prosecutors filed separate charges against a resident running impersonation schemes targeting users.
Coinbase Global Inc. CEO Brian Armstrong has confirmed the arrest of a former customer service contractor in India.
The arrest connects to a May security breach where hackers bribed contractors to access sensitive customer data. The perpetrators demanded $20 million in ransom from the San Francisco-based exchange.
This development marks progress in the ongoing investigation into one of crypto’s most notable platform breaches.
Security Breach Details and Financial Impact
Coinbase disclosed the hacking incident in May after discovering that external contractors had been compromised.
Hackers successfully bribed contractors or employees operating outside the United States to obtain customer information. The breach represented one of the most prominent security failures at a major cryptocurrency trading platform this year.
The exchange estimated potential remediation costs could reach up to $400 million. This figure accounts for investigation expenses, system upgrades, and customer protection measures.
The ransom demand of $20 million paled in comparison to the projected recovery expenses facing the company.
Coinbase shares experienced a 1.2% decline to $236.79 following the arrest announcement on Friday. The stock has dropped approximately 4.6% year-to-date.
Market reaction suggests investors remain cautious about ongoing security concerns and potential financial exposure from the incident.
Law Enforcement Collaboration and Additional Charges
A Coinbase spokesperson confirmed the arrest in India through official channels. The confirmation followed collaborative efforts between the exchange and international law enforcement agencies.
Hyderabad Police executed the arrest of the former customer service agent involved in the data theft scheme.
The arrest comes alongside recent work with the Brooklyn District Attorney’s Office on related matters. Prosecutors in Brooklyn filed charges against a local resident accused of operating an impersonation scheme.
The scheme specifically targeted Coinbase customers through fraudulent communications and identity theft tactics.
Armstrong addressed the arrest through social media, emphasizing the company’s enforcement stance. “We have zero tolerance for bad behavior and will continue to work with law enforcement,” he stated.
We have zero tolerance for bad behavior and will continue to work with law enforcement to bring bad actors to justice.
Thanks to the Hyderabad Police in India, an ex-Coinbase customer service agent was just arrested. Another one down and more still to come.
— Brian Armstrong (@brian_armstrong) December 26, 2025
The CEO added that authorities brought bad actors to justice with assistance from Hyderabad Police. Armstrong indicated more arrests could follow as investigations continue across multiple jurisdictions.
The exchange maintains its commitment to customer security despite the breach fallout. Coinbase continues coordinating with various law enforcement agencies to identify additional perpetrators.
The company has implemented enhanced vetting procedures for contractors and employees handling sensitive customer data. These measures aim to prevent similar breaches while the investigation proceeds through legal channels in multiple countries.
