Cheap contracts, valuable access: the market behind Coinbase’s bribed agents
Coinbase’s May 2025 disclosure showed criminals buying data from outsourced support staff who could already see it. Insider risk in support operations behaves like a market, and financial institutions set its terms through how they buy and govern outsourced labor.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On May 15, 2025, Coinbase disclosed in an SEC filing that criminals had paid contractors and employees in support roles outside the United States. They had copied customer data from internal tools. The data included names, contact details, masked Social Security and bank account numbers, government ID images and account information. It did not include passwords, private keys or the ability to move funds. The company said its own monitoring had detected the improper access in prior months and that the people involved had been fired. On May 11 the company received an extortion demand for $20 million. Coinbase refused to pay, offered a $20 million reward for information leading to arrests, and said it would reimburse customers tricked into sending funds. It estimated related costs at roughly $180 million to $400 million.
Insider threat programs are usually built for the rare bad actor: a disgruntled administrator, a rogue trader. The Coinbase case followed a different pattern. An outside buyer recruited people in a support operation and paid them for access they already had as part of the job. That turns insider risk into something closer to a market, with a buyer, a seller and rules that govern the trade. Banks, credit unions, broker-dealers and fintechs that run or outsource large contact centers can manage each side of it. This analysis takes them in turn: the buyer’s demand, the agent’s supply, and the outsourcing terms that set the rules of the market. Questions of console design and data masking are a separate topic, and we leave them aside here.
The buyer’s demand: what a support seat is worth
A support agent at a financial firm can usually see enough to make a customer an easy target. Name, phone number, balance and recent activity let a fraud ring call a customer while posing as the firm’s security team, with details that make the call believable. For crypto holders, whose transfers are hard to reverse, that script is especially lucrative. The Coinbase cost estimate shows the scale: the firm put its exposure at many times the extortion demand.
Demand also has a structure. Criminal buyers prefer seats that can view many customers, high-balance customers, and identity documents. They prefer large sites, where one recruiter can approach many agents through social media or messaging apps. They prefer locations where a modest payment is large relative to local wages. Each of those preferences is visible in advance to a firm planning a support operation. Security teams should brief procurement on them before the next sourcing decision, not after a disclosure.
The agent’s supply: wages, tenure and consequences
On the other side sits the agent’s calculation. Large support operations, especially outsourced ones in lower-cost locations, often run on modest pay and high turnover. An agent who expects to leave within a year, earns little and faces at most dismissal has less to lose than a long-tenured employee with a career at stake. That says nothing about the character of individuals. It describes incentives the firm helped create when it bought support on price.
Several levers change the calculation. Prosecution is the strongest. An agent who knows that the provider and the client will pursue criminal charges, and that local police have done so before, weighs a bribe differently. Tenure is another. Programs that pay retention bonuses or offer a path into better-paid roles raise the cost of losing the job. A confidential channel for reporting bribe approaches, with a reward large enough to matter locally, turns some recruitment attempts into intelligence. The same messaging channels criminals use to recruit can be used to warn: periodic briefings that describe real approaches remove the ambiguity a recruiter relies on.
The market rules: what the outsourcing contract says
Most institutions never set a wage at their outsourcing provider. They do set the contract, and that is where the market’s rules are written. Contact center contracts are typically priced per contact or per agent hour, with service levels on handle time and answer speed. Those terms reward the provider for cheap, fast seats with broad access. They are silent on most of what drives insider risk.
A better contract adds terms the provider must evidence:
- Screening standards equivalent to the institution’s own, adapted to local law.
- Attrition reporting by site and team, because sudden churn can signal a recruitment campaign.
- On-site work for seats with customer data, with no personal phones on the floor.
- Removal of an agent within a set time on the institution’s request.
- A commitment to refer misconduct to law enforcement and support prosecution.
- Near-real-time access logs delivered to the institution’s own monitoring team.
The interagency guidance on third-party risk management issued in 2023 is explicit that outsourcing an activity does not outsource responsibility for it.
Those terms cost money, and providers will price them. That is the trade-off institutions should make openly. A support contract that is a few percent dearer but comes with supervision, evidence and enforcement may be far cheaper than one incident. Coinbase’s experience also shows the limit of detection alone. The company spotted the improper access in the months before the extortion attempt, and the data was already gone. Terms that shrink demand and supply work before data leaves.
Concentration is a final market rule. Many institutions place most of their support volume with one provider at one or two sites. That makes the operation easier to manage and easier for a recruiter to target. Splitting high-access work across sites, or keeping the most sensitive queues in-house while outsourcing routine contacts, changes where a buyer can shop. It also adds management overhead, which is why the decision belongs in the sourcing case rather than in an after-the-fact security review.
The three parts point to one operating rule. Assume some people with access will be offered money, and manage the terms of that offer through sourcing decisions. Those decisions belong in workforce and procurement planning, where support capacity is bought, and not only in the security program that inherits the result.
With hindsight
Reuters reported in mid-2025 that agents involved worked for the outsourcing firm TaskUs in Indore, India. TaskUs said it had dismissed employees for illegal access and stopped its Coinbase work there in early January 2025. Coinbase told the Maine attorney general that about 69,000 customers would be notified. Customer lawsuits followed within days of the disclosure.
What held up through 2026 is the market framing. The case was cited throughout 2025 alongside help-desk social engineering attacks on retailers and insurers, as evidence that attackers were investing in people with access. The weakest point in many institutions remained the outsourcing contract itself, still priced per contact. Institutions that renegotiated those terms gained evidence and enforcement rights that a per-contact price never buys.