INSIGHTS
Coinbase: bribed support agents and 307 million in costs
In May 2025 Coinbase disclosed that support staff at an outsourced supplier, paid by criminals, had copied data on tens of thousands of customers, with a 20 million dollar demand refused and 307 million in costs. The analysis: dishonesty at the supplier, voluntary reimbursements, D&O and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, May 2025 · by cybercoverinsurance
On 14 May 2025 Coinbase, one of the largest US cryptocurrency platforms, told the SEC that customer support staff, paid by criminals, had copied customer data from internal systems. On 11 May a demand for 20 million dollars had arrived in exchange for not publishing it. Coinbase did not pay, offered a reward of the same amount for information on the perpetrators and estimated costs of 180 to 400 million dollars, for remediation and for reimbursing customers scammed with that data.
There was no technical intrusion and no theft of funds from accounts. The loss ran through support staff at an outsourced supplier, and then through customers, deceived by scammers who knew their data. For cyber and crime underwriters, the case touches three points: dishonesty by people working for a supplier, voluntary reimbursements to customers and the handling of disclosure to the market.
What is known
The disclosure. In its Form 8-K Coinbase wrote that an attacker had paid contractors or employees in support roles, working outside the United States, to collect data from internal systems. Security monitoring had detected the access in previous months, and the personnel involved had been terminated. The data included name, address, phone, email, the last four digits of the Social Security number, masked bank account details, government ID images, balances and transaction history, and some internal documents. Passwords, private keys and customer funds were not touched. Preliminary costs were estimated at about 180 to 400 million dollars, for remediation and voluntary reimbursements to customers who had sent funds to the attackers (Coinbase, Form 8-K).
The ransom and the reward. The demand was 20 million dollars. Coinbase refused and offered 20 million for information leading to the arrest and conviction of the perpetrators. The data concerned less than 1% of monthly transacting users. The share price fell more than 7% (The Register).
The supplier. According to Reuters, as reported by CryptoSlate, the staff worked for TaskUs, a Texas-based outsourcing company, at its centre in Indore, India. Coinbase was reportedly alerted as early as January 2025, when an agent was caught photographing data. A filing with the Maine Attorney General lists 69,461 customers affected. Coinbase then ended its relationship with TaskUs. A securities fraud class action against Coinbase and a negligence suit against TaskUs followed (CryptoSlate).
The bill. In its second quarter 2025 results Coinbase reported 307 million dollars of costs related to the incident (The Block). In December 2025 CEO Brian Armstrong announced the arrest in Hyderabad, India, of a former support agent. TaskUs said two of its employees had been recruited by a criminal campaign that had also hit other Coinbase suppliers (The Block).
What is not known. Whether and how much of the 307 million was recovered from insurers or the supplier is not public. The dates of first access and first discovery come from press reports and lawsuits, not from the Form 8-K.
The dishonest insider works for the supplier
Insider risk is also external. The staff were not Coinbase employees but a supplier's. For the insured the loss is the same, but for the policy the difference matters. Employee dishonesty cover in crime policies often covers the insured's employees and, only where stated, third-party staff under its direction.
Support sees too much. First-line support staff could see ID images, balances and transaction history. For a financial service, that is broad exposure granted to outsourced staff in another country. It is the point the criminals bought.
Monitoring worked, containment did not. Coinbase detected the access and terminated the staff before the ransom demand (Form 8-K). But the data had already left. For underwriters, detection is not enough: what matters is how much data can leave before detection.
The voluntary reimbursement
A scammed customer is not a third-party loss in the strict sense. Customers lost funds because scammers, with their data, presented themselves credibly. Coinbase chose to reimburse them. Cyber policies usually cover established or claimed liability to third parties, and many exclude voluntary payments made without the insurer's consent.
Reimbursement protects the brand and reduces lawsuits. For a platform that lives on customer trust, reimbursement is a rational business choice. But it is an item that can fall outside cover, unless the policy provides for reputation protection costs or reimbursements agreed with the insurer.
The reward is not a ransom, but it is not covered. The 20 million offered for information on the perpetrators is a crisis management choice. Extortion cover pays, where provided, the payment to the extortionist and advisers, not a bounty.
From breach to D&O
The discovery date becomes a legal question. The securities class action alleges that Coinbase delayed disclosure (CryptoSlate). The issue is the moment an incident becomes material to investors, under the SEC's rules on disclosure within four business days.
The cyber claim generates a D&O claim. Shareholder suits target the company and its leadership, and fall under D&O policies. For an insurer writing both lines for the same company, a cyber incident is one event with two correlated claims.
What to bring to renewals
Impact for insurersHigh
Support staff at an outsourced supplier, paid by criminals, copied data on tens of thousands of customers, with 307 million dollars of costs across remediation and voluntary reimbursements.
On the portfolio side, many financial services and platforms outsource customer support to the same large providers. Campaigns to bribe agents can hit several clients of the same supplier, as TaskUs indicated for Coinbase. Knowing who provides support to insureds is the first step in estimating aggregation.