Coinbase Drops on Reports of SEC Investigation, Hacking

Bloomberg's stacy-marie ishmael breaks down reporting by the New York Times that reveals cryptocurrency exchange Coinbase is facing an ongoing investigation by the SEC. The report alleges that the company misstated its user numbers and comes on the heels of reports that workers leaked sensitive user data to hackers.

Coinbase Global Inc. is cooperating with the US Securities and Exchange Commission on an agency probe into its previously reported user metrics, the company said Thursday.

“This is a hold-over investigation from the prior administration about a metric we stopped reporting two and a half years ago, which was fully disclosed to the public,” Paul Grewal, Coinbase’s chief legal officer, said in a statement. “While we strongly believe this investigation should not continue, we remain committed to working with the SEC to bring this matter to a close.”

Grewal noted that Coinbase’s “verified users metric” might have overstated the number of unique customers and that the company continues to disclose “the more relevant metric of ‘monthly transacting users’” on the platform.

The SEC declined to comment.

The New York Times, citing people familiar with the matter, reported earlier Thursday that the agency has been investigating whether Coinbase had misstated user numbers in disclosures.

Under the Trump administration, the SEC has dropped more than 10 high-profile crypto-enforcement cases, including a lawsuit against Coinbase.

Separately, the company said earlier Thursday that hackers had offered cash to Coinbase customer support agents to steal sensitive data and demanded a $20 million ransom, which the company refused to pay. It estimated the incident could cost the firm up to $400 million to remedy.

Hackers had near-constant access to some of Coinbase Global Inc.’s most valuable customer data since January, according to a person familiar with the incident who asked not to be named discussing company matters.

The largest US crypto exchange disclosed earlier on Thursday that hackers bribed customer representatives to steal the data and then demanded a $20 million ransom to delete it. Coinbase began noticing unusual activity from some of these representatives in January, the company confirmed in an interview with Bloomberg News.

The hackers bribed customer service representatives to get access to names, dates of birth, addresses, nationalities, government-issued ID numbers, some banking details and details about when customer’s accounts were created and their balance, the person familiar with the situation said. This information could be used to attempt to impersonate Coinbase and convince customers to let the hackers into their account. It could also be used to impersonate the victims with other service providers to attempt to convince them to let hackers into other financial accounts they might own.

The threat actors had bribed enough customer service representatives to achieve effectively on-demand access to Coinbase customer information in the past five months, the person said. In an interview with Bloomberg News, Chief Security Officer Philip Martin disputed the near constant access assertion, saying Coinbase pulled the agents’ access as soon as it was discovered they were improperly sharing information. Therefore the hackers “did not have persistent access over the course of the entire period,” he said.

“What these attackers were doing was finding Coinbase employees and contractors based in India who were associated with our business process outsourcing or support operations, that kind of thing and bribing them in order to obtain customer data,” Martin said.

Coinbase detected the agents and quarantined them and fired them, as soon as the company noticed the activity.

The incident comes as Coinbase is set to join the S&P 500 index next week. Inclusion in the benchmark is becoming more important for companies in a world increasingly dominated by passive investment funds, wrapping Coinbase’s stock into numerous trackers following the index. Coinbase shares slipped 7% to $244.89 as of 3:03 p.m. in New York.

Coinbase said in a blog post that the breach didn't include login credentials like passwords or 2FA codes.

More details here:

--------

Watch Bloomberg Radio LIVE on YouTube

Weekdays 7am-6pm ET

Follow us on X

Subscribe to our Podcasts:

Bloomberg Daybreak

Bloomberg Surveillance

Bloomberg Intelligence

Balance of Power

Bloomberg Businessweek

Listen on Apple CarPlay and Android Auto with the Bloomberg Business app:

Apple CarPlay

Android Auto