India Detains Ex-Coinbase Support Employee in Connection with Data Breach: Armstrong

33

Authorities in India have apprehended a former customer service representative of Coinbase in Hyderabad related to the data breach of the revealed earlier this year, as stated by Coinbase CEO Brian Armstrong.

Key Takeaways:

  • A former Coinbase support staff member was detained in India due to a data breach impacting nearly 70,000 users.
  • Coinbase declined a $20 million ransom and faced $307 million in costs associated with the breach.
  • This incident contributes to increasing legal and security challenges for the exchange.

“We maintain a strict stance against misconduct and will persist in collaborating with law enforcement to ensure that wrongdoers are held accountable,” Armstrong mentioned in a post on X on Thursday. “One down, and more to follow.”

The breach, which Coinbase indicated commenced in December 2024, originated from a bribery scheme aimed at offshore customer support personnel.

Coinbase Breach Exposed Data of Nearly 70,000 Users

Cybercriminals reportedly compensated customer service agents to gain access to internal systems and retrieve sensitive user data, including names, addresses, phone numbers, and government-issued IDs.

Coinbase revealed in a report to the Maine Attorney General’s Office that 69,461 users were impacted.

The attackers subsequently demanded a ransom of $20 million, which Coinbase opted not to pay. Instead, the company initiated a corresponding bounty program, offering rewards for information that could assist in arrests and asset recovery.

An investigation by Fortune connected the incident to customer support agents employed by TaskUs, a Texas-based business process outsourcing company with operations in India.

TaskUs stated it had identified two employees who were allegedly recruited as part of a wider criminal initiative that also targeted other service providers assisting Coinbase.

We have zero tolerance for bad behavior and will continue to work with law enforcement to bring bad actors to justice.
Thanks to the Hyderabad Police in India, an ex-Coinbase customer service agent was just arrested. Another one down and more still to come.

— Brian Armstrong (@brian_armstrong) December 26, 2025

Coinbase reported $307 million in costs related to the breach in its second-quarter earnings, which included remediation efforts and reimbursements to affected users.

The company is also contending with a shareholder class action lawsuit, which claims that Coinbase did not disclose the breach promptly.

The arrest in India occurred just days after US prosecutors charged a Brooklyn resident with operating a separate phishing scheme that allegedly defrauded approximately 100 Coinbase users of $16 million.

Blockchain investigator ZachXBT contributed to identifying the suspect.

Coinbase shares fell about 1.2% to $236.90 on Friday. Indian law enforcement has not released a public statement regarding the arrest.

Brooklyn Man Charged in $16M Crypto Scam Targeting Coinbase Users

As reported, US prosecutors have charged a 23-year-old resident of Brooklyn, Ronald Spektor, with stealing around $16 million in cryptocurrency from about 100 Coinbase users through an alleged phishing and social engineering scheme.

According to the Brooklyn District Attorney’s Office, Spektor impersonated a Coinbase employee and reached out to victims, claiming their funds were in immediate danger, pressuring them to transfer cryptocurrency to wallets he controlled.

Authorities indicated that the scheme utilized panic tactics rather than technical hacks. Operating under the online alias “lolimfeelingevil,” Spektor allegedly warned victims of imminent theft to bypass skepticism and compel rapid decisions.

Once the funds were transferred, prosecutors claim he attempted to obscure their origin by routing assets through crypto mixers, token swaps, and online gambling platforms.

Spektor was arraigned on 31 charges, including first-degree grand larceny and money laundering, following a year-long investigation.

Law enforcement has seized approximately $105,000 in cash and $400,000 in digital assets thus far, with ongoing efforts to recover additional funds.

The post India Arrests Former Coinbase Support Agent Over Data Breach: Armstrong appeared first on Cryptonews.