Coinbase Global (COIN) Shares Tumble After Cyberattack, SEC Probe

Shares fell over 7% to close just above $244 Thursday, after surging earlier in the week on news that Coinbase will join the S&P 500 next Monday.

Coinbase Global (NASDAQ:COIN) shares slumped Thursday after the company said it had been the victim of a cyberattack, and as a report emerged the Securities and Exchange Commission is investigating the platform.

Shares fell over 7% to close just above $244 Thursday, after surging earlier in the week on news that Coinbase will join the S&P 500 next Monday. With Thursday's losses, the stock slipped back into negative territory for 2025.

Coinbase Estimates Data Breach Costs at $180M to $400M

The online cryptocurrency exchange said in an SEC filing that it received "an email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation" on May 11.

The company added that the "threat actor" likely got the information by paying non-U.S. based contractors and other employees "to collect information from internal Coinbase systems to which they had access."

"The communication demanded money in exchange for not publicly disclosing the information," the filing said. Coinbase said it has not paid the demand and is working with law enforcement. Its investigation is still ongoing, but Coinbase said it expects the incident to cost between roughly $180 million and $400 million "relating to remediation costs and voluntary customer reimbursements."

Coinbase said no passwords or customer funds were ever accessed. However, it said names, addresses, phone numbers, email addresses, last four digits of Social Security numbers, masked bank account numbers, and Coinbase account data like "balance snapshots and transaction history" may have been compromised.

Coinbase Calls SEC Probe 'Hold-Over Investigation' From Biden Administration

Separately Thursday, The New York Times reported the SEC is investigating Coinbase's use of a metric tracking "verified users" in regulatory filings, which said Coinbase had over 100 million verified users ahead of its 2021 initial public offering. The company stopped using the metric in filings in 2023, opting to instead focus on "monthly transacting users" as a more representative number of the platform's users.

“This is a hold-over investigation from the prior administration about a metric we stopped reporting two and a half years ago, which was fully disclosed to the public," Coinbase's Chief Legal Officer Paul Grewal said in a statement to Investopedia.

“While we strongly believe this investigation should not continue, we remain committed to working with the SEC to bring this matter to a close,” Grewal said. An SEC spokesperson declined to comment on the report.

This article has been updated since it was first published with the latest share price values, and information about a report regarding an SEC investigation into Coinbase's metrics.