In This Article:
Coinbase's stock (COIN) closed down 7% on Thursday after two developments raised new questions about the company's controls and regulatory headaches.
First, the US crypto exchange disclosed that cyberattackers had stolen sensitive customer data and threatened to publish it unless the company paid a $20 million ransom.
Then the New York Times reported that the Securities and Exchange Commission still has an open investigation into whether Coinbase misreported user data years ago.
Coinbase said no passwords or private crypto wallet codes had been compromised by the cyberattack and that the data leak affected less than 1% of Coinbase's monthly transacting customers, according to a blog post.
Separately, Coinbase's chief legal officer Paul Grewal shared his response to the New York Times with Yahoo Finance, saying the SEC matter was "a holdover investigation from the prior administration about a metric we stopped reporting two and a half years ago,” adding that "we remain committed to working with the SEC to bring this matter to a close."
The SEC declined to comment.
The two developments Thursday represented an unexpected setback for Coinbase, the largest US cryptocurrency exchange, following a series of wins this year as the crypto world gained deeper mainstream acceptance on Wall Street and in Washington, D.C.
Last week, the company announced a $2.9 billion acquisition of crypto options exchange Deribit. Earlier this week, Coinbase's stock soared after it was officially added to the S&P 500 index (^GSPC).
"Coinbase joining the S&P 500 means crypto's here to stay," Armstrong said in a Yahoo Finance interview on Capitol Hill Wednesday.
"It's going to be in everybody's 401(k). Everyone's going to have crypto exposure at least indirectly through Coinbase. And it's also a symbol that crypto is updating the financial system," Armstrong added.
On Thursday morning, Armstrong posted a video on X addressing the breach.
He explained that instead of paying the ransom, Coinbase is establishing a $20 million reward or bounty program for information leading to the arrest and conviction of the attackers. He also said the company is planning to reimburse customers affected by the incident.
"No, we're not going to pay your ransom," Coinbase CEO Brian Armstrong said.
"These attackers had been approaching our overseas customer support agents, looking for a weak link, someone to accept a bribe in exchange for sharing some customer information," Armstrong said.