Coinbase Faces Class-Action Suit as Investor Alleges Hidden Cyberattack and UK Fine Drove Stock Down

Coinbase Sued by Investor Over Breach Fallout and Regulatory Violation

Coinbase is facing growing legal trouble after shareholder Brady Nessler filed a proposed class-action lawsuit, accusing the crypto exchange of failing to disclose critical information that allegedly triggered a sharp decline in its stock price.

The lawsuit, submitted on 22 May in a federal court in Pennsylvania, names CEO Brian Armstrong and CFO Alesia Haas among the defendants.

Nessler claims the company misled investors by withholding details of a serious security breach and a prior regulatory violation in the UK, both of which significantly impacted Coinbase’s market value.

The complaint seeks damages on behalf of shareholders who bought Coinbase stock between 14 April 2021 and 14 May 2025.

Cyberattack And $20 Million Extortion Attempt

At the heart of the lawsuit is a cyberattack that targeted Coinbase in December 2024 but wasn’t publicly disclosed until 15 May 2025.

According to the company, hackers bribed overseas customer service agents to access internal systems and steal sensitive personal data from users, including government-issued IDs, names and addresses.

Coinbase reported that fewer than 1% of its monthly active users were affected, later confirming that data from at least 69,461 accounts had been compromised.

The attackers demanded a $20 million ransom, which Coinbase refused to pay.

Instead, the company offered a $20 million bounty to identify those responsible.

The late disclosure spooked investors.

Coinbase’s stock (COIN) fell by 7.2% on 15 May, closing at $244.

It briefly recovered to $266 the next day but slipped again, closing at $263.16 on 23 May.

The company also estimated the financial impact from the incident could cost between $180 million and $400 million in damages and remediation.

Regulatory Breach In The UK Resurfaces

Nessler’s complaint also points to a £4.5 million fine Coinbase received from the UK Financial Conduct Authority in July 2024.

The FCA found that Coinbase’s UK subsidiary, CB Payments, had breached a 2020 agreement by onboarding 13,416 high-risk users without proper oversight.

Coinbase was supposed to avoid such customers under the voluntary terms of the agreement.

According to the lawsuit, Coinbase never disclosed this breach when it went public in 2021, allegedly inflating the company’s share price by concealing risk.

The stock reportedly dropped over 5% following the FCA fine, closing at $231.52 on 25 July 2024.

Nessler argues that had investors known about the violation earlier, they may have reconsidered purchasing the stock.

The suit claims,

“The market price of the Company’s securities had been artificially inflated.”

Mounting Legal Pressure On Coinbase

This isn’t the only lawsuit Coinbase is battling.

The company has been hit with at least six other legal actions since disclosing the breach.

Most of them allege that Coinbase mishandled user data and failed to protect customers from security threats.

One suit filed in Illinois on 13 May claims Coinbase violated biometric privacy laws by collecting and storing users’ biometric data—such as facial recognition—without notifying them in writing about its use or retention policies.

The breach is also under investigation by the US Department of Justice, adding further scrutiny to the exchange’s handling of sensitive user information and internal controls.

Coinbase said it had dismissed employees involved in the data theft and promised to improve security protocols.

Coinbase has not yet responded publicly to Nessler’s allegations or the broader wave of legal complaints currently underway.