An arrest has been made in the Coinbase ransomware breach

A former Coinbase customer service agent in India who allegedly helped hackers steal sensitive customer information from its database was arrested in India.

Coinbase CEO Brian Armstrong said in a post on X on Dec. 26 that more arrests are to come.

"We have zero tolerance for bad behavior and will continue to work with law enforcement to bring bad actors to justice," Armstrong posted. "Thanks to the Hyderabad Police in India, an ex-Coinbase customer service agent was just arrested. Another one down and more still to come."

This Tweet is currently unavailable. It might be loading or has been removed.

These support agents allegedly gave access to hackers as part of a May 2025 incident in which hackers demanded a $20 million ransom in exchange for not publicly leaking stolen customer data, according to Bleeping Computer.

As Mashable reported at the time, Coinbase said the hackers obtained names, addresses, phone numbers, email addresses, masked bank account numbers, photos of government IDs, and the last four digits of customers' social security numbers. On top of that, the hackers also accessed account data, including balance snapshots and transaction history.

Despite this, Coinbase refused to pay the $20 million ransom, instead offering a $20 million reward fund for anyone providing information on the people responsible for the breach. At this time, it's not clear if the reward fund played a role in the recent arrest in India.

"At Coinbase, we work directly with law enforcement, using blockchain tracing and other tools to help identify offenders and support prosecutions and we will not stop," a Coinbase spokesperson told BleepingComputer.