29th December 2025 – (Hyderabad) Indian law enforcement has arrested a former Coinbase customer support agent in Hyderabad in connection with a major data breach at the cryptocurrency exchange that was disclosed earlier this year, Coinbase chief executive Brian Armstrong has confirmed. Armstrong, writing on X on Thursday, said the company would continue to pursue those responsible. “We have zero tolerance for bad behaviour and will continue to work with law enforcement to bring bad actors to justice. Another one down and more still to come,” he stated.
The breach, which Coinbase has said began in December 2024, arose from a bribery scheme targeting offshore customer service staff. Cybercriminals are alleged to have paid support agents to gain access to internal systems and exfiltrate sensitive user data, including names, home addresses, telephone numbers and details from government-issued identity documents.
In a filing to the Maine Attorney General’s Office, Coinbase disclosed that 69,461 customers were affected by the incident. The attackers subsequently demanded a ransom of US$20 million, which the exchange refused to pay. Instead, Coinbase set up a matching bounty programme, offering rewards for information that could help identify those responsible and aid in asset recovery.
Reporting by Fortune later linked the intrusion to staff at TaskUs, a Texas-based business process outsourcing firm with operations in India that provides customer support services to Coinbase. TaskUs has said it identified two employees who were allegedly recruited into a wider criminal operation that also targeted other service providers working with the exchange.
Coinbase reported US$307 million in breach-related expenses in its second-quarter results, covering remediation work, security enhancements and reimbursements to affected users. The episode has fuelled rising legal and regulatory scrutiny of the company, including a shareholder class action that accuses Coinbase of failing to disclose the breach promptly to investors.
The Hyderabad arrest comes just days after U.S. prosecutors charged a Brooklyn resident in a separate criminal case involving Coinbase users. In that matter, 23-year-old Ronald Spektor is accused of stealing approximately US$16 million in cryptocurrency from about 100 Coinbase customers through an alleged phishing and social engineering scheme.
According to the Brooklyn District Attorney’s Office, the suspect posed as a Coinbase employee and contacted victims claiming their funds were in immediate danger, urging them to move cryptocurrency into wallets under his control. Prosecutors say the fraud relied on high-pressure “panic” tactics rather than technical exploitation, with the defendant allegedly operating online under the alias “lolimfeelingevil”.
Once the victims’ funds were transferred, the assets were allegedly laundered through cryptocurrency mixers, token swaps and online gambling platforms in an effort to conceal their origin. The defendant has been arraigned on 31 counts, including first-degree grand larceny and money laundering, following a year-long investigation.
Authorities in New York have so far seized around US$105,000 in cash and US$400,000 in digital assets, with efforts continuing to recover additional funds. Blockchain investigator ZachXBT has been credited with assisting in the identification of the suspect.
Coinbase shares slipped about 1.2% to US$236.90 on Friday. As of publication, Indian authorities had not issued a public statement regarding the arrest in Hyderabad.