Coinbase, a globally renowned cryptocurrency exchange, has encountered its first wave of headwinds after announcing its inclusion in the S&P 500 index. The company's stock price experienced a significant 7% drop in a single day, pointing to two simultaneously developing negative events: first, information security concerns arising from potential internal employee data leakage, and second, a strict review of Coinbase user data by the U.S. Securities and Exchange Commission (SEC). These events not only put substantial pressure on Coinbase's short-term stock performance but also bring the core issues of compliance, information security, and regulatory pressure for cryptocurrency companies back to market scrutiny.
Security Alert: Employee Leak
According to Coinbase's announcement yesterday (15th), external parties obtained approximately 1% of data through social engineering and bribery. Coinbase received a ransom demand of up to $20 million. The company stated that they have not reached any agreement with the perpetrators, have fully notified all potential victims, and have issued a massive bounty to arrest these criminals.
Despite the official's stern statement, this undoubtedly severely undermines users' trust in the platform's security protection capabilities. More deeply, if the leaked data is misused, it could potentially lead to broader social engineering attacks and internal system infiltration.
Coinbase has promised to fully compensate all affected users if the leaked data causes any property losses, and emphasized that they are strengthening account risk control, user reminders, and improving customer service and community response.
SEC Investigation: Accuracy of 'Verified Users' Data
On the other hand, according to a New York Times report citing informed sources, the SEC is investigating the accuracy of Coinbase's previously disclosed "verified users" data in regulatory documents, believing there might be fabrication or misrepresentation. Particularly around its 2021 Initial Public Offering (IPO), Coinbase claimed to have over 100 million "verified users", an indicator that was crucial in demonstrating the platform's potential for listing on markets like NASDAQ.
However, around two years later, in 2022, Coinbase stopped citing the "verified users" indicator in its public reports. The company explained in its 2022 financial statement that it no longer believed this metric provided meaningful information about its business performance. In a 2023 securities document, they stated they would instead disclose "monthly transacting users (MTUs)", believing this better reflects the platform's actual activity and overall performance.
Coinbase Response: Biden Administration's Toxic Legacy
Coinbase's Chief Legal Officer, Paul Grewal, confirmed the investigation in a statement, explaining:
The 'verified users' metric includes anyone who has verified their email address or phone number, so it may overestimate the number of unique customers
Regarding the SEC investigation, Coinbase described it as a "toxic legacy of the Biden administration". Coinbase's Chief Legal Officer Paul Grewal stated that under the Trump administration, the SEC had withdrawn over ten high-profile cryptocurrency enforcement cases, including a 2023 lawsuit against Coinbase. He believes it is unfair to apply the same standards:
This is an investigation left over from the previous (Biden) administration, an investigation about an indicator we stopped reporting two and a half years ago and fully disclosed to the public. While we firmly believe this investigation should not continue, we remain committed to cooperating with the SEC to resolve this matter. Nevertheless, Coinbase has hired the renowned Davis Polk & Wardwell law firm to assist with this matter.
Regardless, involvement in the SEC investigation has already affected some investors' perception of Coinbase's reputation, especially early IPO participants.
Market Reaction
The market's significant stock price decline reflects investors' deep concerns about the company's current internal security risk management and ability to handle external regulatory pressures.
Although the company emphasizes that user funds and passwords are unaffected, sensitive personal information such as names, addresses, phone numbers, and partial social security numbers may have been leaked. Facing both an investigation and data breach, Coinbase has recently made some positive business developments, such as announcing an acquisition to expand its global business and its upcoming inclusion in the S&P 500 index, which is typically seen as recognition of the company's scale and market position. The subsequent developments are expected to keep Coinbase in a consolidation period.
