Coinbase shares fell sharply after a double blow of troubling developments. Firstly, a cyberattack that compromised customer information and second, the ongoing U.S. Securities and Exchange Commission (SEC) probe, which alleges possibly inflated user numbers.
Shares of Coinbase (COIN) tumbled 7% in after-hours trading on May 15, dropping to $244, according to Google Finance. The market reaction followed a report by The New York Times confirming that the SEC is actively investigating Coinbase’s 2021 claim of having over 100 million “verified users.” The inquiry, which began during the Biden administration and has continued into the Trump administration, questions the accuracy of figures used in the company’s public disclosures and IPO materials.
The SEC’s concern centers around Coinbase’s widely publicized “100+ million verified users” figure, a metric the company stopped reporting in 2022. Despite the shift, the investigation persists.
“This is a hold-over investigation from the prior administration about a metric we stopped reporting two and a half years ago, which was fully disclosed to the public,” said Paul Grewal, Coinbase’s Chief Legal Officer, in a statement to Cointelegraph.
“We also disclosed – and continue to disclose – the more relevant metric of ‘monthly transacting users’ – the number of people who use our platform in a given month,” he continued, adding that the company believes the investigation is unwarranted but remains cooperative with the SEC in hopes of resolving the issue.
Coinbase has enlisted legal heavyweight Davis Polk & Wardwell to navigate the regulatory scrutiny.
Compounding its troubles, Coinbase revealed on May 15 that it had been targeted in a cyberattack involving a $20 million ransom attempt. Cybercriminals reportedly enlisted overseas customer service agents to leak user account data.
“These insiders abused their access to customer support systems to steal the account data for a small subset of customers,” the company disclosed.
Despite the extortion attempt, Coinbase firmly declined to pay the ransom. However, it has pledged to reimburse victims of related phishing attacks. The anticipated remediation and reimbursement costs are projected to range from $180 million to $400 million.
As Coinbase deals with the dual crises of regulatory scrutiny and security breaches, the company continues to emphasize transparency and user trust. This turbulence comes just as the firm prepares to make history as the first crypto company to join the S&P 500—an ironic twist amid growing concerns over its operational integrity.
