Indian authorities have arrested a former Coinbase customer service agent in Hyderabad in connection with the crypto exchange's data breach disclosed earlier this year, according to Coinbase CEO Brian Armstrong.
"We have zero tolerance for bad behavior and will continue to work with law enforcement to bring bad actors to justice," Armstrong said in a post on X on Thursday. "Another one down and more still to come."
The breach, which Coinbase said began in December 2024, stemmed from a bribery scheme targeting offshore customer support staff.
Cybercriminals allegedly paid customer service agents to access internal systems and extract sensitive user information, including names, addresses, phone numbers and government-issued identification.
Coinbase disclosed in a filing with the Maine Attorney General's Office that 69,461 users were affected.
The attackers later demanded a $20 million ransom, which Coinbase refused to pay. Instead, the company launched a matching bounty program, offering rewards for information that could lead to arrests and asset recovery.
A subsequent investigation by Fortune linked the incident to customer support agents working for TaskUs, a Texas-based business process outsourcing firm with operations in India.
TaskUs said it had identified two employees who were allegedly recruited as part of a broader criminal campaign that also targeted other service providers supporting Coinbase.
Coinbase reported $307 million in breach-related costs in its second-quarter earnings, covering remediation efforts and reimbursements to affected customers.
The company is also facing a shareholder class action lawsuit, which alleges that Coinbase failed to disclose the breach in a timely manner.
The arrest in India comes just days after US prosecutors charged a Brooklyn resident with running a separate phishing scheme that allegedly stole $16 million from roughly 100 Coinbase users.
Blockchain investigator ZachXBT played a role in identifying the suspect.
Coinbase shares slipped about 1.2% to $236.90 on Friday. Indian law enforcement has not issued a public statement on the arrest.
As reported, US prosecutors have charged a 23-year-old Brooklyn resident, Ronald Spektor, with stealing roughly $16 million in cryptocurrency from around 100 Coinbase users through an alleged phishing and social engineering scheme.
According to the Brooklyn District Attorney's Office, Spektor posed as a Coinbase employee and contacted victims claiming their funds were at immediate risk, pressuring them to transfer crypto to wallets he controlled.
Authorities said the scheme relied on panic tactics rather than technical hacks. Operating under the online alias "lolimfeelingevil," Spektor allegedly warned victims of imminent theft to override skepticism and force quick decisions.
Once funds were transferred, prosecutors say he attempted to hide their origin by routing assets through crypto mixers, token swaps and online gambling platforms.
Spektor was arraigned on 31 charges, including first-degree grand larceny and money laundering, following a year-long investigation.
Law enforcement has seized about $105,000 in cash and $400,000 in digital assets so far, with efforts ongoing to recover more funds.