On May 11, the firm reported receiving a communication from an unidentified threat actor.
In their announcement, the company stated, “Customers who were misled into transferring funds to the perpetrator will be reimbursed.”
They added, “We are collaborating closely with law enforcement to ensure the strictest penalties for those involved, and we have decided against paying the $20 million ransom that was requested.”
“Instead, we’re creating a reward fund of $20 million for information that leads to the capture and prosecution of the criminals responsible for this incident.”
According to a report filed with the US Securities and Exchange Commission, external, potential costs are estimated to fall between $180 million and $400 million.
This projection is based on “remediation expenses and voluntary reimbursements for customers,” although it may adjust due to “possible losses, indemnification claims, and potential recovery efforts.”
Employees who disclosed customer data to the attackers have been terminated.
Coinbase warned its users to anticipate further scams and urged them to stay alert.
“Please be aware that Coinbase will never solicit your password, 2FA codes, or request you to transfer assets to a specific or new address, account, vault, or wallet,” they cautioned.
Additionally, they advised customers to secure their accounts if they have any suspicions.
“To our affected customers, we apologize for the distress and inconvenience caused by this situation,” the firm stated.
“We will continue to take accountability for issues as they arise.”