NEW YORK, December 28, 2025, 19:16 ET — Market closed
- Coinbase CEO Brian Armstrong said a former customer service agent was arrested in India in connection with an exchange data-breach case.
- Coinbase shares last fell 1.2% in Friday’s session; bitcoin was little changed near $87,800 on Sunday.
- Investors head into Monday watching for more updates on breach-related costs and year-end macro data.
Coinbase Global (COIN.O) Chief Executive Brian Armstrong said a former customer service agent had been arrested in India in connection with a security breach, keeping the U.S. crypto exchange’s shares in focus ahead of Monday’s session. Coinbase shares fell 1.2% in the previous session to $236.90. [1]
The arrest reopens investor attention on an incident that raised questions about insider access to customer-support tools — and the cost of cleaning up after a breach. In a May regulatory filing, Coinbase estimated expenses of about $180 million to $400 million for remediation and voluntary customer reimbursements related to the incident. [2]
For traders, the update lands as crypto prices have steadied into the final week of the year, leaving company-specific headlines with more room to drive the stock. Any follow-on disclosures about enforcement actions, customer impact or financial exposure are likely to be closely watched.
“We have zero tolerance for bad behavior,” Armstrong wrote on X in a post referencing the arrest. [3]
Coinbase disclosed in May that it had received an email from an unknown threat actor claiming to have obtained information about certain customer accounts and internal documentation related to customer-service and account-management systems, a filing showed. The filing said the attacker appeared to have obtained the information by paying multiple contractors or employees in support roles outside the United States to collect data from internal systems. [4]
The company said the incident did not involve compromised passwords or “private keys” — the secret codes that control access to crypto — and that the support personnel were not able to access customer funds. [5]
Coinbase said the affected data included names and contact information, masked Social Security digits, masked bank-account numbers, some government-ID images, and account data such as balance snapshots and transaction history. [6]
The company said it did not pay the threat actor’s demand and was cooperating with law enforcement. [7]
In a May blog post, Coinbase said it would reimburse customers who were tricked into sending funds to the attacker and said it would not pay a $20 million ransom demand, instead setting up a $20 million reward fund for information leading to arrest and conviction of those responsible. [8]
Bitcoin was little changed at about $87,815 on Sunday. Coinbase shares tend to move with crypto prices and trading activity, which can drive transaction revenue for exchanges.
Before Monday’s session, investors will watch for further details from Coinbase or authorities about the arrest and any next steps in the investigation, including whether the company updates its estimate of breach-related costs.
Markets will also be eyeing U.S. data on Monday, including pending home sales at 10:00 a.m. ET, as investors gauge risk appetite into year-end positioning. [9]
Coinbase’s next quarterly update is also on the horizon. The Nasdaq earnings calendar lists an estimated report date of Feb. 12, 2026, though such dates can shift ahead of a formal company announcement. [10]
Technically, Coinbase shares traded between $232.96 and $241.40 in the last session, a range traders may use as near-term reference points when markets reopen.
References
1. x.com, 2. www.sec.gov, 3. x.com, 4. www.sec.gov, 5. www.sec.gov, 6. www.sec.gov, 7. www.sec.gov, 8. www.coinbase.com, 9. www.marketwatch.com, 10. www.nasdaq.com
