A Wave of Lawsuits Targets Coinbase's Security Flaws

Coinbase, the leading U.S.-based cryptocurrency exchange, is under fire as at least six class action lawsuits were filed against it between May 15 and May 16, 2025.

Coinbase, the largest U.S. cryptocurrency exchange, was hit with multiple class action lawsuits on Monday, May 15, and Tuesday, May 16, following a data breach that exposed 69,000 users and sparked outrage over alleged security failures.

Coinbase is facing at least six class action lawsuits, which were filed in federal courts across New York and California. The lawsuits arise from a significant data breach that affected 69,461 users, as announced earlier in May.

Coinbase hackers bribed overseas support agents to steal personal and financial data, leading to a $20 million bounty announced by the exchange for information that could help in the arrest of the culprits.

However, the lawsuits accuse Coinbase of failing to maintain stringent security protocols, leaving users vulnerable to identity theft and financial fraud.

The lawsuits claim Coinbase’s negligence could lead to “substantial, immediate, and ongoing threats” for affected users, with potential long-term consequences since the compromised data cannot be recovered.

One lawsuit in California even demands that Coinbase purge sensitive user data and hire third-party auditors to test its security systems.

Meanwhile, the community has raised concerns over the time frame of the breach, highlighting that it began as early as December 26, 2024, and continued until Coinbase received a credible ransom note in May 2025.

The exchange refused to pay the $20 million ransom and has instead focused on reimbursing users who were tricked by phishing scammers into sending crypto to the wrong addresses.

Coinbase has estimated that these expenses could range from $180 million to $400 million, as disclosed in a filing with the U.S. Securities and Exchange Commission.

Coinbase’s stock price dipped 3.2% in after-hours trading on May 27, after a 2.4% decline during regular trading. This downturn followed a report by The Block about several class action lawsuits being filed against the exchange.

The lawsuits target Coinbase for allegedly failing to notify users in a timely manner about the data breach, despite having sufficient knowledge.

Earlier in May, hackers reportedly stole user data and attempted to extort $20 million from Coinbase. However, the exchange refused to pay the ransom and instead announced a bounty of the same amount for information that could lead to the hackers’ arrest.

Coinbase is also facing criticism for its response to the incident, with some social media users expressing frustration over the exchange’s handling of the situation.

Coinbase has not yet responded to a request for comment on the lawsuits. However, the exchange previously announced plans to purge sensitive user data and provide users with two years of credit monitoring services.

Coinbase is no stranger to legal troubles. In 2023, a group of Coinbase users filed a class action lawsuit against the exchange, alleging that the platform’s security flaws led to the theft of cryptocurrency from their accounts.

The lawsuit, filed in a San Francisco federal court, accuses Coinbase of failing to adequately protect user funds and promptly notify users of any security breaches.

The plaintiffs claim that Coinbase was aware of the security vulnerabilities but failed to take reasonable steps to mitigate them, rendering users susceptible to theft.

The lawsuit also alleges that Coinbase’s response to the breaches was inadequate, with the exchange making light of the situation and attempting to shift blame onto users.

Coinbase has not yet responded to the lawsuits. However, the exchange is known for its commitment to user security and has implemented several measures to protect user funds.

Despite these efforts, Coinbase has been the target of several cyberattacks in recent years. In 2022, hackers attempted to steal $1 billion in cryptocurrency from Coinbase Pro users.

The hackers gained access to a small number of employee credentials, which they used to attempt to withdraw cryptocurrency from Coinbase Pro accounts. However, Coinbase was able to identify and prevent the hackers from stealing any user funds.

Coinbase is also a member of the Cryptocurrency Security Center, a non-profit organization that is dedicated to promoting best practices for cryptocurrency security.

The Center provides a wide range of resources to cryptocurrency businesses and users, including a code of conduct, a framework for responsible disclosure, and a platform for reporting security vulnerabilities.

Coinbase is committed to working with other members of the cryptocurrency community to improve the security of the industry as a whole.