Coinbase is under fresh legal fire after a major data breach and subsequent stock price plunge sparked a new class-action lawsuit from investors. The suit, filed in the U.S. District Court for the Eastern District of Pennsylvania, accuses the company and its top executives of concealing critical information about the breach and regulatory violations- allegations that have rocked both shareholders and the wider crypto industry.

Breach Details

The controversy centers on a data breach that reportedly began in late December 2024 and continued for several months. According to Coinbase’s filings, at least 69,461 customers sensitive personal and financial information stolen, including names, addresses, phone numbers, government-issued IDs, account balances, and transaction histories. The breach was orchestrated by cybercriminals who bribed overseas customer support agents to gain unauthorized access to internal systems. The hackers then attempted to extort $20 million from Coinbase in exchange for deleting the stolen data- a demand the company refused.

Coinbase did not publicly disclose the breach until May 15, 2025, after receiving a credible ransom note. The delayed disclosure has become a central issue in the lawsuit, with investors claiming that the company’s lack of transparency resulted in significant financial losses when the news finally broke.

Stock Price Fallout

The market’s reaction was swift and severe. On May 15, after Coinbase revealed the breach, its stock (COIN) plummeted by 7.2%, closing at $244. The lawsuit, led by investor Brady Nessler, alleges that this sharp decline directly resulted from Coinbase’s failure to promptly inform shareholders about the breach and its potential impact.

Regulatory Woes Compound the Crisis

Complicating matters further, the lawsuit also points to regulatory troubles in the UK. In July 2024, Coinbase’s UK subsidiary was fined £3.5 million (about $4.5 million) by the Financial Conduct Authority (FCA) for violating a 2020 agreement that barred the company from onboarding high-risk customers. The FCA found that Coinbase had allowed over 13,000 such users to access its services, facilitating nearly $226 million in crypto transactions.

The suit alleges that Coinbase failed to disclose this regulatory breach to investors, further misleading them about the company’s operational integrity and compliance standards. When the FCA fine was announced, Coinbase’s stock dropped another 5.5%, closing at $231.52 on July 25, 2024.

A Wave of Lawsuits

This latest class-action suit is one of at least six lawsuits filed against Coinbase in the wake of the data breach. Plaintiffs across these cases accuse the company of mishandling the incident, failing to implement adequate security safeguards, and not providing timely or sufficient information to affected users and investors. The lawsuits collectively claim that Coinbase’s response to the breach was “inadequate, fragmented, and delayed,” exposing users to ongoing risks of identity theft and financial fraud.

What Next?

The new class-action seeks monetary damages, reimbursement of legal fees, and a jury trial. It covers anyone who purchased Coinbase stock between April 14, 2021, and May 14, 2025. As of now, Coinbase has not issued a public statement regarding the Nessler lawsuit. While Coinbase’s stock has shown some resilience, recovering slightly after the initial drop, the legal and reputational fallout from the breach and regulatory violations continues to cast a shadow over the company’s future.