Coinbase is facing growing legal trouble after shareholder Brady Nessler filed a proposed class-action lawsuit, accusing the crypto exchange of failing to disclose critical information that allegedly triggered a sharp decline in its stock price.
The lawsuit, submitted on 22 May in a federal court in Pennsylvania, names CEO Brian Armstrong and CFO Alesia Haas among the defendants.
Nessler claims the company misled investors by withholding details of a serious security breach and a prior regulatory violation in the UK, both of which significantly impacted Coinbase’s market value.
The complaint seeks damages on behalf of shareholders who bought Coinbase stock between 14 April 2021 and 14 May 2025.
At the heart of the lawsuit is a cyberattack that targeted Coinbase in December 2024 but wasn’t publicly disclosed until 15 May 2025.
According to the company, hackers bribed overseas customer service agents to access internal systems and steal sensitive personal data from users, including government-issued IDs, names and addresses.
Coinbase reported that fewer than 1% of its monthly active users were affected, later confirming that data from at least 69,461 accounts had been compromised.
The attackers demanded a $20 million ransom, which Coinbase refused to pay.
Instead, the company offered a $20 million bounty to identify those responsible.
The late disclosure spooked investors.
Coinbase’s stock (COIN) fell by 7.2% on 15 May, closing at $244.
It briefly recovered to $266 the next day but slipped again, closing at $263.16 on 23 May.
The company also estimated the financial impact from the incident could cost between $180 million and $400 million in damages and remediation.
Nessler’s complaint also points to a £4.5 million fine Coinbase received from the UK Financial Conduct Authority in July 2024.
The FCA found that Coinbase’s UK subsidiary, CB Payments, had breached a 2020 agreement by onboarding 13,416 high-risk users without proper oversight.
Coinbase was supposed to avoid such customers under the voluntary terms of the agreement.
According to the lawsuit, Coinbase never disclosed this breach when it went public in 2021, allegedly inflating the company’s share price by concealing risk.
The stock reportedly dropped over 5% following the FCA fine, closing at $231.52 on 25 July 2024.
Nessler argues that had investors known about the violation earlier, they may have reconsidered purchasing the stock.
The suit claims,
“The market price of the Company’s securities had been artificially inflated.”
This isn’t the only lawsuit Coinbase is battling.
The company has been hit with at least six other legal actions since disclosing the breach.
Most of them allege that Coinbase mishandled user data and failed to protect customers from security threats.
One suit filed in Illinois on 13 May claims Coinbase violated biometric privacy laws by collecting and storing users’ biometric data—such as facial recognition—without notifying them in writing about its use or retention policies.
The breach is also under investigation by the US Department of Justice, adding further scrutiny to the exchange’s handling of sensitive user information and internal controls.
Coinbase said it had dismissed employees involved in the data theft and promised to improve security protocols.
Coinbase has not yet responded publicly to Nessler’s allegations or the broader wave of legal complaints currently underway.
Australia’s financial intelligence agency, AUSTRAC, has launched a sweeping crackdown on inactive registered crypto exchanges, aiming to eliminate potential vehicles for fraud and financial crime.
KikyoRussia is planning to introduce criminal penalties for illegal crypto mining, targeting those using cheap energy without proper registration. The move comes as mining activity rises and more regions consider bans due to power strain.
WeatherlyElon Musk’s D.O.G.E initiative under Trump aimed to cut federal spending, but costs still climbed. Despite shutting 11 agencies, ending foreign aid, and cutting $10B from education, the budget grew—and 240,000 government jobs were lost. Was D.O.G.E a cost-cutter, or just a reshuffle?
CatherineThe SEC has closed its investigation into PayPal’s stablecoin PYUSD without taking any action. This clears the way for PayPal to expand its crypto plans, including partnerships and a new rewards programme for users.
AnaisAvi Eisenberg was sentenced to 52 months in prison for possessing over 1,200 CSAM images, while still facing legal fallout from his $110M Mango Markets exploit. Though convicted of crypto fraud, his lawyers seek a retrial—raising questions about whether the punishment fits the scale of his crimes.
CatherineMalaysian authorities seized 45 illegal Bitcoin mining machines worth $52,145, part of a broader crackdown on operations causing $8,342 in monthly electricity theft. While no arrests were made, investigations continue amidst rising losses tied to international groups exploiting the region’s power grid.
KikyoKraken caught a North Korean hacker trying to get a job by spotting inconsistencies during the interview process. The crypto firm used the opportunity to uncover a network of fake identities linked to state-backed cybercrime.
AnaisMesh has partnered with Apple Pay to enable seamless crypto payments for consumers, with merchants receiving stablecoin payouts—no crypto infrastructure required. The integration will launch for both online and physical retailers by Q2 2025.
CatherineEthereum R1 launched as a new layer-2 solution without a token or central control, aiming to keep Ethereum scaling neutral and decentralised. It runs on donations and has sparked debate about whether token-free models could shape the future of Ethereum’s ecosystem.
WeatherlyA licensed Black Mirror token is launching, using AI to assign dynamic reputation scores based on blockchain and social activity. Powered by a virtual assistant named Iris, the system rewards high-scoring users with airdrops and perks—blurring the line between digital behaviour and real-world incentives.
Kikyo