Coinbase Data Breach Leads to Social Engineering Attacks

On Thursday, May 15, leading cryptocurrency exchange service Coinbase suffered a data breach that impacted nearly 70,000 customers. Threat actors leveraged the stolen data to execute social engineering attacks in an attempt to steal cryptocurrency from Coinbase customers. The threat actor also demanded a $20 million ransom from Coinbase in exchange for not releasing the stolen data and halting further social engineering attacks. The financial impact of the breach is currently estimated to be between $180 and $400 million.
 

What’s Notable and Unique

• The data impacted includes names, dates of birth, last four digits of social security numbers, masked bank account numbers and some bank account identifiers, addresses, phone numbers, and email addresses.
• For some users, the impacted information also included images of government identification information (e.g., driver’s license number, passport number, national identity card number) and account information (including transaction history, balance, transfers, account opening date).
• Coinbase is offering up to $20 million for information that aids in the identification of the threat actor or supports the law enforcement investigation. Additionally, Coinbase stated they will reimburse customers who were victims of the social engineering attacks following the breach.
• Coinbase also cautioned customers to be aware of threat actors impersonating Coinbase employees in attempts to obtain funds or user information like passwords or MFA codes.

 

Analyst Comments

The Coinbase breach is the latest in several attacks against cryptocurrency service providers. The difference between this breach and other attacks, such as the one targeting Bybit, is that threat actors in previous attacks conducted crypto-heist operations to siphon cryptocurrency directly from the exchange. This attacker, however, focused on obtaining user information that would allow threat actors to continue extorting individuals through social engineering tactics in the medium to long term.
 
It is possible that data theft incidents targeting cryptocurrency companies could increase in the near future. As the frequency of ransom payments continues to fall, the multi-faceted opportunities of this type of attack becomes increasingly attractive to cybercriminals, as they can demand ransoms from the cryptocurrency provider itself, conduct social engineering attacks against its customers, or attempt to siphon cryptocurrency directly.
 

Sources

Coinbase Under Federal Investigation After Massive Data Breach

After Coinbase Hack, Experts Warn: It’s Not Just Data at Risk

Coinbase says recent data breach impacts 69,461 customers