India Arrests Former Coinbase Agent in $400M Breach Case
- Indian police arrested a former support agent linked to the $400 million Coinbase breach.
- Hackers bribed overseas staff to access Coinbase customer data, excluding passwords.
- Coinbase is working with Indian and U.S. authorities as the multi-country probe expands.
Indian police have arrested a former customer service agent tied to the $400 million Coinbase data breach, marking a key step in a global investigation. The arrest follows months of cooperation between Coinbase and law enforcement agencies. Officials say the suspect helped hackers access customer records by abusing internal support systems used by the exchange. Earlier disclosures confirmed the incident scale.
The arrest was confirmed by Coinbase Chief Executive Officer Brian Armstrong in a public statement. He praised the Hyderabad Police for their work on the case. Armstrong said the company has zero tolerance for internal misconduct. He added that Coinbase will continue supporting investigations until all responsible parties are identified.
Coinbase Data Breach Linked to Bribed Support Staff and Ransom Demand
The case stems from a data breach disclosed by Coinbase earlier this year. Hackers gained access to customer information by bribing overseas employees and contractors.
The compromised data included names, home addresses, and email addresses. Coinbase stated that passwords, private keys, and login credentials were not accessed.
Investigators say the arrested individual worked in a customer support role connected to outsourced operations. According to Coinbase, attackers specifically targeted support staff who had limited but direct access to customer data. These insiders were allegedly paid to extract information from internal systems. The method allowed hackers to bypass external security defenses.
Coinbase revealed that the breach became fully known in May 2025. After securing customer data, the attackers demanded a $20 million ransom. They threatened to release the information if payment was not made. Coinbase refused to comply with the demand and instead offered a $20 million reward for information leading to arrests.
The company later estimated the total financial impact of the breach. Losses were placed between $180 million and $400 million. The figure included customer reimbursements, investigation costs, and system upgrades. Coinbase said it had detected suspicious activity months before the ransom demand surfaced.
Coinbase Chief Security Officer Philip Martin explained how the scheme operated. He said attackers focused on employees and contractors linked to support operations in India. These individuals were approached and bribed for access. Martin noted that early warning signs appeared as early as January.
Related: Brooklyn DA Charges Suspect in $16M Coinbase Support Scam
Coinbase Works With Indian and U.S. Authorities as Investigation Expands
The arrest was part of a joint effort involving multiple jurisdictions. Coinbase confirmed it has worked closely with Indian authorities and U.S. prosecutors. The Brooklyn District Attorney’s Office is among the agencies involved. Officials said further arrests remain possible as investigations continue.
The development comes as Coinbase rebuilds its presence in India. The exchange recently returned after facing nearly two years of regulatory challenges. Cooperation with local law enforcement has been described as constructive. The case may influence future compliance discussions in the region.
The incident highlights wider security risks across the crypto industry. In February, rival exchange Bybit reported a separate attack that caused losses of about $1.5 billion. Blockchain analytics firm Chainalysis reported $3.4 billion in total crypto hack losses during 2025
