Coinbase forecast a financial impact of $180 m to $400 m from a cyberattack that compromised account data of a “small subset” of its clients, according to a regulatory filing.
On 11 May 2025, the company received an email from an unknown threat actor claiming to have information about certain customer accounts and internal documents.
While some data, including names, addresses and emails, was stolen, Coinbase stated that the hackers did not gain access to login credentials or passwords. The company will, however, reimburse clients who were deceived into sending funds to the attackers.
As the first publicly traded cryptocurrency exchange, Coinbase paved the way for the digital asset industry’s integration into the mainstream financial system. It safeguards the majority of the $122 bn in tokens held by spot-Bitcoin exchange-traded funds. Additionally, it undertook most of the heavy lifting in the industry’s campaign‑spending blitz to elect a group of crypto‑friendly politicians to Washington this year.
Cause and Affect
Hackers had enlisted numerous contractors and employees in support roles outside the United States to gather information. The company stated that the individuals responsible have been terminated.
The disclosure of the hack comes just three days after Coinbase’s crowning achievement in mainstreaming the digital asset class: its inclusion in the S&P 500 Index, which will place its shares in trillions of dollars’ worth of retirement plans and other investment products that track the benchmark index. The hack, combined with reports of an ongoing US Securities and Exchange Commission inquiry into how the company overstated its user counts, drove the stock down more than 7 % on Thursday.
Separately, the US Securities and Exchange Commission launched an investigation into whether Coinbase misstated its user numbers, according to two individuals familiar with the matter.
These individuals noted that the agency was also examining whether any inaccurate user data might indicate that the company failed to meet the SEC’s requirements for know-your-customer compliance.
A Coinbase spokesperson denied that the SEC was investigating the company’s compliance with know-your-customer and Bank Secrecy Act regulations.
