Crypto firm Coinbase hacked, faces SEC scrutiny

What happened

Coinbase, the largest U.S.-based cryptocurrency exchange, said Thursday that cybercriminals had hacked the company, stealing sensitive user data for a scheme to rob customers of crypto assets and extort the company.

The Securities and Exchange Commission is also investigating Coinbase for allegedly overstating its active users in securities filings, The New York Times reported Thursday.

Who said what

Coinbase said in an SEC filing that an undisclosed number of user names, addresses and government ID images were stolen by someone paying multiple now-fired "contractors or employees working in support roles outside the United States." It estimated it would have to spend $180 million to $400 million to fix the situation and reimburse customers.

The stolen data allowed the hacker to "conduct social engineering attacks" on users to "try to trick them into sending their funds," CEO Brian Armstrong said. Coinbase said the hackers had demanded $20 million in bitcoin to not release the user data, but the company instead would offer that same amount for information about the criminals. "We will prosecute you and bring you to justice," Armstrong said. "You have my answer."

What next?

The ongoing SEC investigation is a rare crypto-linked case that "began during the Biden administration and has continued" under President Donald Trump, the Times said. Since Trump took office, "the SEC has dropped more than a dozen lawsuits and investigations targeting crypto firms," including a separate 2023 case against Coinbase, and "largely disbanded its specialized crypto unit."