Coinbase (COIN) shares drop more than 7% after disclosing a cyberattack and an ongoing SEC investigation

The stock fell to just above $244, giving up gains from earlier in the week when Coinbase was set to join the S&P 500 index.

Coinbase (NASDAQ:COIN) shares dropped sharply on Thursday after the crypto platform disclosed a cyberattack and confirmed an ongoing Securities and Exchange Commission investigation.

The stock fell more than 7% to just above $244, giving up gains from earlier in the week when Coinbase was set to join the S&P 500 index. The drop pushed its 2025 performance back into negative territory.

The company said in a filing that on May 11 it received a ransom email from an unidentified actor who claimed to have accessed customer account data and internal company files. Coinbase believes international contractors and employees were paid to extract the data.

The threat actor demanded payment to keep the data from going public. Coinbase said it has not paid and is cooperating with law enforcement. It estimates the financial impact of the breach will be between $180 million and $400 million, covering remediation efforts and voluntary reimbursements.

Coinbase said passwords and customer funds were not accessed. However, exposed data may include names, addresses, phone numbers, masked bank account details, and transaction histories.

The company is contacting affected individuals and providing them with complimentary credit monitoring and identity theft protection.

Separately, Coinbase is being investigated by the SEC for its prior use of the verified users metric, which the firm used through 2021 and removed from filings in 2023. The company now focuses on monthly transacting users.

Coinbase said the probe is a continuation of an inquiry that began last year and relates to the company's public reporting.

The company said it disclosed the metric fully and transparently in accordance with applicable reporting requirements at the time. It added that it is cooperating fully with the regulator but believes the matter should be closed.

"We are disappointed that despite this cooperation, the SEC continues to pursue this investigation, particularly given the significant inconvenience it is causing our employees, contractors and users," Coinbase said.