Cryptocurrency exchange giant Coinbase has warned of a financial hit ranging between $180 million and $400 million following a sophisticated cyberattack that compromised data from less than 1% of its users.

The hackers reportedly gained access by bribing external contractors and support staff outside the US to leak sensitive customer information including names, addresses and emails.

Coinbase confirmed login credentials and passwords were not exposed, but attackers used the stolen data to impersonate the company and scam customers.

Coinbase, which is days away from joining the S&P 500 index, refused a $20 million ransom and instead offered a $20 million reward for information leading to the hackers’ arrest.

The company pledged to reimburse all affected customers who were deceived into sending crypto assets to the attackers.

The incident has triggered scrutiny from the US Securities and Exchange Commission (SEC), which is investigating whether Coinbase misrepresented user data in past disclosures. However, the company denied any probe into its know-your-customer (KYC) compliance.

Shares in Coinbase fell over 7% following the announcement, compounding the reputational blow as it prepares for a major stock market milestone.

The cyberattack reflects growing threats in the digital asset sector, which saw an estimated $2.2 billion in stolen fundsacross 2024, according to blockchain analytics firm Chainalysis.

Coinbase said it had terminated staff involved, is working with law enforcement, and will enhance internal controls including opening a new US-based support hub.

“We’re sorry for the worry and inconvenience,” Coinbase said in a statement. “We’ll keep owning issues when they arise and strengthen security across our platform.”