Coinbase Stock Drops 7% Amid Cyberattack, SEC Probe

Coinbase, the largest US cryptocurrency exchange, experienced a significant setback on May 15 as its stock closed down 7%. The decline was triggered by two major developments: a cyberattack that compromised sensitive customer data and an ongoing investigation by the Securities and Exchange Commission (SEC) into the company's user data reporting practices.

The cyberattack involved hackers stealing sensitive customer information and demanding a $20 million ransom to prevent the data from being published. Coinbase responded by announcing a $20 million reward program for information leading to the arrest and conviction of the attackers. The company also assured customers that no passwords or private crypto wallet codes were compromised, and the data leak affected less than 1% of its monthly transacting customers. Coinbase CEO Brian Armstrong stated that the attackers had been targeting overseas customer support agents, attempting to bribe them for customer information. Armstrong emphasized that the company would not pay the ransom and instead planned to reimburse affected customers.

Separately, the SEC has an open investigation into whether Coinbase misreported user data years ago. Coinbase's chief legal officer, Paul Grewal, addressed the matter, stating that it was a "holdover investigation from the prior administration about a metric we stopped reporting two and a half years ago." Grewal reiterated the company's commitment to working with the SEC to resolve the issue. The SEC declined to comment on the investigation.

The probe has continued despite the SEC dropping its 2023 enforcement lawsuit against Coinbase. Coinbase has hired law firm Davis Polk & Wardwell to assist with its response to the SEC. The regulator took specific umbrage at Coinbase’s claim of “100+ million verified users” that appeared in its marketing and IPO documentation in 2021. However, the exchange stopped reporting this metric in 2022. In its 2022 financial statement, the firm stated it would stop reporting the metric as it no longer believed it provided meaningful information to its business performance.

These developments represent a significant challenge for Coinbase, which has recently seen a series of wins, including a $2.9 billion acquisition of crypto options exchange Deribit and its addition to the S&P 500 index. CEO Brian Armstrong had previously expressed optimism about the company's future, stating that Coinbase joining the S&P 500 was a symbol that crypto is updating the financial system. However, the recent events have cast a shadow over these achievements, raising questions about the company's security measures and regulatory compliance.

The cyberattack and SEC investigation highlight the ongoing challenges faced by cryptocurrency exchanges in maintaining customer trust and navigating regulatory scrutiny. Coinbase's response to the cyberattack, including the establishment of a bounty program and the commitment to reimburse affected customers, demonstrates the company's efforts to address the breach and mitigate its impact. However, the SEC investigation underscores the need for continued vigilance and transparency in reporting practices. As the cryptocurrency industry continues to evolve, exchanges like Coinbase will need to adapt to new challenges and maintain their commitment to security and regulatory compliance.