Coinbase, one of the world’s largest cryptocurrency exchanges, saw its stock tumble 7% in after-hours trading to $244 on 15 May, following reports of a significant cyberattack and a revived US Securities and Exchange Commission (SEC) investigation into its user metrics.

SEC Questions 2021 ‘Verified Users’ Claim

The SEC is investigating whether Coinbase misrepresented the number of users in its 2021 disclosures, notably its claim of having “100+ million verified users” during its IPO. The probe, which began during the Biden administration, is ongoing under the Trump administration.

In response, Coinbase confirmed the investigation and defended its past disclosures. “This is a hold-over investigation from the prior administration about a metric we stopped reporting two and a half years ago, which was fully disclosed to the public,” said Paul Grewal, the company’s chief legal officer.

Grewal emphasised that Coinbase now reports “monthly transacting users” as a more accurate metric, stating, “We strongly believe this investigation should not continue, but we remain committed to working with the SEC to bring this matter to a close.”

Despite the SEC dropping its enforcement lawsuit against Coinbase in 2023, the user count investigation remains active. To support its case, Coinbase has enlisted top law firm Davis Polk & Wardwell.

Cyberattack Triggers Data Breach and Ransom Demand

Adding to the pressure, Coinbase revealed it was the target of a cyberattack involving a $20 million extortion attempt. Hackers reportedly recruited overseas customer service agents who misused their access to steal data from a “small subset” of users.

“These insiders abused their access to customer support systems to steal the account data for a small subset of customers,” Coinbase confirmed in a statement.

The company declined to pay the ransom but assured users it would compensate victims affected by phishing attacks resulting from the breach. Estimated costs for remediation and reimbursement range between $180 million and $400 million.

Investors React to Dual Crisis

The combination of regulatory scrutiny and a serious security breach shook investor confidence, triggering a sharp drop in Coinbase’s stock value. As of the evening of 15 May, shares had fallen by 7%, reflecting market unease over both issues.

Focus on Transparency and Recovery

While the situation poses a serious challenge to Coinbase, the company insists it is being transparent in addressing both the SEC inquiry and the cyberattack fallout. By switching its focus to more relevant user engagement metrics and offering financial redress to affected customers, Coinbase aims to restore investor trust and regulatory compliance.

The crypto exchange has yet to confirm the total number of customers affected by the data breach or whether further legal consequences may arise.