Coinbase CEO praises Hyderabad Police after arrest linked to $400 million cyberattack case

Cyberattack

Brian Armstrong, co-founder and chief executive of Coinbase, has acknowledged the role of Indian law enforcement in a major breakthrough related to one of the company’s most serious security incidents this year. In a post shared online, Armstrong thanked the Hyderabad Police for arresting a former Coinbase customer service agent accused of participating in a cyberattack and extortion operation that targeted the exchange and its users.

“We have zero tolerance for bad behaviour and will continue to work with law enforcement to bring bad actors to justice,” Armstrong wrote. He added that the arrest in India marked meaningful progress in an investigation that is still ongoing, ending his post with the line, “Another one down and more still to come.”

The arrest is linked to a cyberattack disclosed earlier this year, when Coinbase confirmed that account data belonging to a small subset of customers had been compromised. The company later revealed that the breach involved a group of overseas customer support agents who had allegedly been bribed by hackers. These insiders are said to have enabled targeted access to user information, which was then used in attempts to extort Coinbase and deceive customers.

At the time of disclosure, Coinbase warned that the financial impact of the incident could be significant, estimating potential costs of up to $400 million. These costs include customer reimbursements, remediation efforts, and wider security improvements.

A Coinbase spokesperson has now confirmed the latest arrest. According to a report by Bloomberg, the company has also filed charges in the United States against a man from Brooklyn accused of running a long-term impersonation scam that targeted Coinbase users. The investigation suggests that the operation involved multiple actors across different countries, reinforcing concerns about insider-assisted cybercrime within global tech platforms.

Coinbase has outlined the scope of data accessed during the breach to reassure customers about what was and was not compromised. The stolen information included names, addresses, phone numbers, and email addresses. In some cases, masked Social Security numbers showing only the last four digits were accessed, along with masked bank account numbers and certain internal identifiers. Hackers also obtained copies of government-issued identification documents such as driving licences and passports, as well as account balances and transaction histories.

The company said that some limited internal documents and communications were also exposed. However, Coinbase stressed that its core infrastructure remained secure. Coinbase Prime systems and wallet infrastructure, including both hot and cold wallets, were not affected by the attack.

Despite the contained nature of the breach, Coinbase expects the financial fallout to be substantial. The company has said it anticipates costs ranging from approximately $180 million to $400 million as it works through incident response measures and compensates affected users.

Armstrong’s public acknowledgement of the Hyderabad Police highlights the increasingly international nature of cybercrime investigations and the reliance of global technology companies on cross-border cooperation. For Coinbase, the arrest represents both a symbolic and practical step forward as it continues efforts to identify all those involved and reinforce trust in its platform.