In brief
- Hackers paid rogue Coinbase customer service staffers to leak sensitive customer information.
- The SEC is investigating whether Coinbase inflated user numbers in prior disclosures.
- The fallout comes just days after the company joined the S&P 500 index.
Coinbase is facing a rough week on multiple fronts, just days after becoming the first crypto-native firm to join the S&P 500 index.
On Thursday, the U.S.’s largest crypto exchange disclosed it had suffered a data breach involving insider collusion and an attempted $20 million Bitcoin blackmail attempt on May 11.
In a video posted online, CEO Brian Armstrong revealed that overseas support agents had accepted bribes from criminals to leak sensitive user data, including names, addresses, partial bank details, and ID documents. Less than 1% of customers were affected, Coinbase said.
The company also said it refused to pay the ransom and is now offering a $20 million bounty for information on those responsible.
The breach has drawn sharp criticism of how much of the infrastructure in crypto still depends on centralized, opaque systems that, according to Phil Mataras, founder of Arweave-based permanent cloud network AR.IO, replicate the vulnerabilities of Web2.
“When access and trust are concentrated in one organization, a single error or insider threat can compromise millions,” he told Decrypt.
“Systems need to minimize dependency on trust-based mechanisms by distributing control as a default, making operations transparent and ensuring critical data can’t be silently altered or lost,” he added.
SEC probe
Adding to the company’s woes, the same day brought fresh revelations that the U.S. Securities and Exchange Commission is investigating whether Coinbase misled investors by overstating its user count in past filings.
The probe, first reported by The New York Times, centers around Coinbase’s claim in its 2021 IPO materials that it had over 100 million “verified users,” a figure the company continued to tout in marketing through 2022.
Coinbase has since retired the metric, saying in a 2023 filing that it was not a reliable indicator of performance.
The company noted that some users may have created multiple accounts and that the stat included anyone who verified an email or phone number.
Chief Legal Officer Paul Grewal described the probe as a “holdover” from the prior administration.
“While we strongly believe this investigation should not continue, we remain committed to working with the SEC to bring this matter to a close,” he added.
The renewed scrutiny comes shortly after the SEC dropped a lawsuit accusing Coinbase of illegal token sales, signaling a thaw in regulatory hostility under a more crypto-friendly SEC chair and government administration.
Coinbase repeatedly sparred with the previous SEC administration under Gary Gensler, criticizing its approach to digital assets as inconsistent and overly aggressive.
The exchange has also been investigated by the SEC over how it generates USDC revenue and its relationship with the stablecoin’s issuer, Circle, a matter Grewal said had been “fully resolved” in a statement last in April.
The same month, the state of Oregon also filed a lawsuit against Coinbase, alleging the exchange violated state securities law.
What the experts think
Still, experts say the probe may not materially impact Coinbase’s long-term trajectory. “Plenty of firms have faced similar cases like these and lived to fight another day,” said Nick Cote, co-founder and CEO of Secondlane.
He compared the situation to Facebook’s $100 million SEC fine in 2019 and Twitter’s $800 million class settlement in 2024.
Legal expert Jack Graves, a professor of law at Syracuse University, believes that Coinbase’s S&P 500 inclusion likely wouldn’t have occurred if the SEC probe posed serious threats.
“I think the data breach is more significant, especially when you consider the history of this industry,” he said. “However, if there is more to the SEC investigation than is presented here, I might change my mind.”
Other crypto insiders were even more dismissive.
Peter Chung of Presto Labs called the Times report a “hit piece,” telling Decrypt that crypto is a new industry and therefore, the best practice on what a reliable metric for crypto exchange users is not firmly established.
“It appears Coinbase has voluntarily changed the reported metric after realizing that the initial figure is misleading, he said. “This is not enough to argue that they were acting in bad faith and deserve to be penalized by the market.”
Coinbase maintains that the metric in question was fully disclosed and appropriately contextualized in its filings, and that it shifted focus to more meaningful indicators like monthly transacting users beginning in 2023.
The company characterized the probe to Decrypt as a legacy matter from the prior SEC administration and said it continues to cooperate with regulators.
Edited by Sebastian Sinclair
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
