Indian Call Centre Agents Accused in $400 Million Coinbase Hack

Mon Jun 02 2025
icon-facebook icon-twitter icon-whatsapp

Key Points

  • Attackers targeted staff at TaskUs
  • TaskUs laid off over 200 Indian employees
  • Indian employees leaked customer data for bribes

ISLAMABAD:  Cryptocurrency giant Coinbase disclosed a significant data breach impacting more than 69,000 customers – marking its most serious security lapse to date.

According to a report by Fortune, the breach, which could result in losses of up to $400 million, occurred after hackers bribed customer service employees in India to obtain sensitive data.

The attackers targeted staff at TaskUs, a US-based company providing customer support to major tech firms. TaskUs has a substantial presence in India, with agents based in Indore handling Coinbase support since 2017, according to Hindustan Times.

In January, shortly after the breach was uncovered, TaskUs laid off over 200 Indian employees working on the Coinbase account.

Salaries at TaskUs in India are typically modest – ranging from $500 to $700 per month. Due to these low wages, some employees were persuaded to share confidential customer information in exchange for bribes.

Severing ties

Coinbase confirmed it had severed ties with those individuals and other international agents involved.

The stolen data did not grant direct access to Coinbase’s crypto reserves. Instead, cybercriminals used it to impersonate Coinbase employees and deceive customers into handing over their digital assets.

These social engineering scams resulted in genuine financial losses, although Coinbase has not disclosed the exact number of affected users. The company has stated it is reimbursing those impacted.

A class action lawsuit has been filed in New York, accusing TaskUs of negligence. The company denies the allegations, calling them unfounded, and says it is taking steps to enhance its security protocols.

TaskUs believes that two of its agents were involved in a wider scheme that targeted multiple service providers connected to Coinbase.

English-speaking cybercriminals

The perpetrators are believed to be part of a loosely organised collective known as “the Comm” or “Community” – a group of young, English-speaking cybercriminals who coordinate via platforms such as Telegram and Discord.

Unlike traditional hacking organisations, the Comm is made up of thrill-seeking teenagers and young adults who often vie for status and recognition online.

One hacker, speaking to media under the alias “puffy party”, explained that different members of the group handled various aspects of the operation – from bribing employees and gathering data to executing the scams.

icon-facebook icon-twitter icon-whatsapp