After the news was released, Coinbase shares kept declining, closing at 7.2%.
Coinbase, the biggest publicly traded cryptocurrency exchange, estimated that a hack that compromised its customers’ account data would cost them between US$180 million and US$40 million.
On Sunday, the company received an email from an unknown individual claiming to have internal documents and information about specific client accounts.
According to Coinbase, information like names, addresses, and emails was stolen, but the hackers could not access their login credentials or passwords. However, they claimed they would reimburse customers duped into paying hackers money.
The company said that attackers had paid many employees and contractors working for the company outside the US to collect information about customers. They fired all of them.
Separately, two sources familiar with the matter state that the US Securities and Exchange Commission (SEC) is investigating whether Coinbase understated its user numbers.
Sources say the inaccurate user data could also indicate that the company did not comply with the SEC’s requirements for know-your-customer (KYC).
A Coinbase representative denied that the SEC was looking into whether the business complied with the Bank Secrecy Act and know-your-customer regulations.
Another source familiar with the matter states that the SEC did not specifically ask questions about such compliance, and it would not be relevant since the SEC dismissed another separate case against Coinbase, charging the company with failing to register with the SEC.
The source added that the investigation about Coinbase’s “verified user” metric persisted even after the SEC dropped its previous lawsuit.
After the news was released, Coinbase shares kept declining, closing at 7.2%.
Coinbase’s chief legal officer, Paul Grewal stated that this investigation was about a metric they stopped reporting like two years, which was fully disclosed to the public.
He added that even if the company wants the enquiry to end, they are still dedicated to collaborating with the SEC to resolve this issue.
The SEC chose not to respond.
The most recent events cloud what was supposed to be a historic time for the cryptocurrency industry, as the company is only days away from joining the benchmark S&P 500 index.
Coinbase’s stock reached the highest level in almost three months, increasing the cryptocurrency exchange’s market worth by almost $8 billion.
After the Coinbase incident, it is concerning to think that despite cryptocurrency gaining mainstream acceptance, security is still a problem for the industry.
Known as the largest cryptocurrency theft in history, Bybit revealed a hack in February that cost around US$1.5 billion worth of digital tokens to be stolen.
According to a Chainalysis report, US$2.2 billion was stolen in 2024 through bitcoin platform hacking.
Bo Pei, an analyst at US Tiger Securities, stated that the cyberattack might force the industry to implement stricter hiring practices to avoid such reputational risks.
Nick Jones, founder of cryptocurrency company Zumo, states the industry is attracting bad actors, and their attacks are getting more complex as the industry gains traction.
The company is currently facing a lawsuit in the Southern District of New York, which claims that the biggest cryptocurrency exchange in the world failed to safeguard and secure the personally identifiable information of millions of its former and present users.
Coinbase declined to pay a $20 million ransom demand from hackers and is now working with the law authorities. Instead, it is ready to pay a US$20 million prize for information about the hackers.
The company is establishing a new help centre in the United States to take additional precautions for these cyberattacks.
Its global shares surged around 15% after the cryptocurrency exchange became the pioneer digital asset player to be on the list benchmark S&P 500 index.
It will replace the credit card issuer Discover Financial (which is purchased by Capital One). The action will take place before trading starts on May 19.