Coinbase Faces Class-Action Lawsuit Over Data Breach, FCA Violation

Coinbase, a leading cryptocurrency exchange, is facing another proposed class-action lawsuit following the disclosure of a user data breach earlier this month. The lawsuit, filed by investor Brady Nessler in a Pennsylvania federal court on May 22, alleges that the data breach and an alleged violation of an agreement with the UK’s Financial Conduct Authority (FCA) resulted in a significant decline in the company's stock value, causing substantial losses for investors.

The data breach, disclosed by Coinbase on May 15, involved an extortion attempt where several customer support agents were bribed to access internal systems and steal user account data. The company estimated potential damages could reach up to $400 million. Nessler's lawsuit claims that the disclosure of this breach caused Coinbase's stock to drop by 7.2% on May 15, closing at $244. However, the stock subsequently recovered, rising by 9% to close at $266 on May 16.

The lawsuit also highlights Coinbase's alleged failure to disclose a previous violation of an agreement with the FCA. In July 2024, the FCA fined Coinbase’s UK arm $4.5 million for onboarding 13,416 high-risk customers and offering them crypto services, which was in breach of a 2020 voluntary agreement. Nessler argues that this fine caused Coinbase's stock to fall by over 5%, closing at $231.52 on July 25, 2024. The lawsuit further claims that Coinbase did not disclose this agreement violation when it first listed its shares on the Nasdaq in April 2021, artificially inflating the market price of its securities.

Nessler claims that had she known about the agreement violation, she would not have purchased the stock at the “artificially inflated prices.” The class-action lawsuit is filed on behalf of anyone who purchased Coinbase stock between April 14, 2021, and May 14, 2025, and seeks damages and a jury trial. The defendants named in the lawsuit include Coinbase, its CEO Brian Armstrong, and chief financial officer Alesia Haas.

This lawsuit is part of a series of legal actions against Coinbase following the data breach disclosure. At least six other lawsuits have been filed, all accusing the exchange of mishandling the incident and failing to protect user data. Additionally, another lawsuit filed in Illinois on May 13 alleges that Coinbase failed to notify users in writing about the collection, storage, or sharing of their biometric data and the purpose and retention schedule for their data.

The legal challenges faced by Coinbase underscore the growing scrutiny and regulatory pressure on cryptocurrency exchanges. The company's handling of the data breach and its compliance with regulatory agreements are now under intense examination, with investors seeking accountability for the financial impact of these incidents. The outcome of these lawsuits could have significant implications for Coinbase and the broader cryptocurrency industry, highlighting the importance of data security and regulatory compliance in maintaining investor trust and market stability.