Coinbase, the leading cryptocurrency exchange, has found itself grappling with a fresh wave of legal challenges as six lawsuits were filed against the firm within two days, following a significant user data breach.
This comes on the heels of a separate class-action lawsuit filed on May 13, alleging violations of the Illinois Biometric Information Privacy Act (BIPA).
In the BIPA lawsuit, filed with the United States District Court of Illinois, plaintiffs Scott Bernstein, Gina Greeder, and James Lonergan claim Coinbase collected biometric faceprints for identity verification without informed consent, failed to disclose data retention policies, and shared data with third-party vendors like Jumio and Onfido, breaching BIPA’s stringent requirements.
The timing couldn’t be worse for Coinbase, which is debuting on the S&P 500 index on May 19, 2025, a key milestone that sent its stock soaring 24%—its biggest gain since the post-election rally after Donald Trump’s victory. The S&P 500 inclusion, which requires consistent profitability, is a boon for Coinbase, with index-tracking funds driving demand for its shares.
However, the celebration and anticipation for Coinbase was short-lived as a major data breach on the exchange revealed sensitive user data, including names, Social Security number fragments, and government-issued IDs. The breach affected less than 1% of users but could cost Coinbase between $180 million and $400 million in remediation.
The mounting lawsuits highlight ongoing concerns about Coinbase’s data security practices, especially as it navigates its new S&P 500 status. The company, which reported a net income of $65.6 million last quarter, now faces a reputational and financial hit, with its stock dropping over 7% since the breach disclosure.
As Coinbase aims to strengthen its security with a new U.S.-based support hub, the crypto giant must address these legal battles to maintain investor confidence in an increasingly volatile market.
