On Thursday, Coinbase CEO Brian Armstrong revealed through a social media message that an email containing a ransom demand had been received. The note solicited $20 million in Bitcoin, threatening to disclose the client information hackers had seized from Coinbase.

“I’m going to respond publicly,” Armstrong said. “We are not going to pay ransom.”

pic.twitter.com/f6UPdkL5R0

— Brian Armstrong (@brian_armstrong) May 15, 2025

Armstrong explained that the cybercriminals identified a “weak link” in a customer service agent based outside the United States, who was “bribed” and subsequently divulged customer personal details.

In a blog post from the company, Coinbase expressed their commitment to compensating customers who were misled into transferring funds to the hackers. The compromised data included names, addresses, phone numbers, emails, as well as partially masked Social Security numbers (only the last four digits), obscured bank-account numbers, and images of government IDs like driver’s licenses and passports. However, the company assured that no passwords or private keys were compromised. The ransom email was received on Sunday.

“(The stolen data) allows them to conduct social engineering attacks where they can call our customers impersonating Coinbase customer support and try to trick them into sending their funds to the attackers,” Armstrong said.

Per the AP, Coinbase estimated in a filing with the SEC that it could end up spending anywhere between $180 million and $400 million “relating to remediation costs and voluntary customer reimbursements relating to this incident.”

Meanwhile, the New York Times reports that the SEC is separately investigating Coinbase over whether or not it reported inaccurate numbers during its IPO in 2021. The company claimed to have more than 100 million “verified users” in marketing materials.

Coinbase’s stock dropped 7% on Thursday after the news, per Yahoo.