The U.S. Department of Justice has launched an investigation into a significant cybersecurity breach at Coinbase, involving insider collusion. According to reports, overseas customer service contractors were bribed by a cybercriminal group to leak sensitive customer information. This data included names, addresses, email addresses, and partially redacted bank details — though no crypto funds or login credentials were compromised.

The breach came to light after a threatening email reached Coinbase on May 11, accompanied by ransom demands totaling $20 million. The hackers threatened to release the stolen data unless the demand was met. Coinbase refused the ransom, instead issuing a $20 million bounty for information leading to the hackers’ arrest.

The attack led to serious fallout, with one customer reportedly losing over $2 million in a targeted scam. Coinbase has since terminated the implicated contractors and is working with international and U.S. law enforcement.

The estimated cost of the breach is between $180 million and $400 million, largely due to legal liabilities and customer reimbursements. Meanwhile, several lawsuits have already been filed by affected users. Coinbase stock dropped more than 7% after the disclosure. DOJ officials clarified that the investigation targets the attackers—not Coinbase itself.