Coinbase. Source: Luciano Luppa - stock.adobe.com

Key Takeaways:

Coinbase fired several India-based support contractors linked to a major social engineering breach affecting user data.
The breach could cost Coinbase up to $400 million in reimbursements and remediation.
The incident highlights significant risks tied to third-party customer support vulnerabilities.

Coinbase has reportedly terminated several customer support contractors in India after allegations emerged that they were involved in social engineering attacks.

According to Chief Security Officer Philip Martin, these agents—believed to be Indian nationals—allowed cybercriminals to access sensitive user data.

Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on <1% of Coinbase MTUs. No passwords, private keys, or funds were exposed. Prime accounts are untouched. We will reimburse impacted customers. More here: https://t.co/SidVn59JCV
— Coinbase 🛡️ (@coinbase) May 15, 2025

The breach, revealed in a May 15 interview, has sparked a surge in phishing attempts and may cost Coinbase between $180 million and $400 million in remediation.

One known target was Qiao Wang, a core contributor to Alliance DAO, who recounted on X how a scammer used personal details—likely obtained through compromised agents—to try to trick him into transferring funds to a fake “Coinbase self-custodial wallet.”

was likely victim of this data breach. got a number of calls from scammers pretending to be coinbase. the scam roughly goes like this

1) they text/call u to tell u ur coinbase account got compromised
2) pretend to do a bunch of a personal info verification, including how much… https://t.co/7MIlFDihXf
— qw (@QwQiao) May 15, 2025

Wang said the scammer claimed to have earned $7 million that day.

While Coinbase hasn’t disclosed how many contractors were involved or shared further details of its internal investigation, the incident highlights the risks of relying on third-party customer support services.

It also raises broader concerns about internal security and the need for stricter oversight of outsourced personnel who handle sensitive user information.