Coinbase lawsuits are piling up following a significant data breach that exposed personal information of users after cybercriminals bribed overseas support staff. 

Between May 15 and 16, at least six class-action lawsuits were filed against the crypto exchange. Plaintiffs are accusing the company of negligence, inadequate cybersecurity, and an insufficient response.

These lawsuits have intensified scrutiny on the company, with legal and regulatory consequences likely to follow.

The U.S. Department of Justice is investigating the cyberattack, but Coinbase itself is not under DOJ investigation, according to Reuters.

Class-Action Coinbase Lawsuits Allege Negligence 

One of the first lawsuits, filed in the U.S. District Court for the Southern District of New York by Paul Bender, claims Coinbase failed to uphold basic security protocols and placed users at serious risk of identity theft and fraud.

According to Bender’s complaint, Coinbase did not promptly notify affected users, offer identity protection, or provide timely support.

A separate suit filed by Maine resident Zaal Panthaki and Texas resident Alexander Crous similarly criticizes Coinbase for failing to adequately train and monitor third-party overseas support staff. They allege that the breach revealed systemic security failures.

Here are six lawsuits already filed of anticipated to be filed in response to the breach:

• Paul Bender (New York): Accuses Coinbase of failing to implement basic cybersecurity protocols.
• Zaal Panthaki and Alexander Crous (New York): Blame undertrained offshore support teams and poor vendor monitoring.
• Rosemary Ortiz (California): Claims Coinbase stored unnecessary sensitive user data, worsening the breach’s impact.
• Unnamed plaintiffs (Multiple jurisdictions): Say Coinbase delayed response and did not help users mitigate damage.
• Proposed class action (National): Seeks accountability for lifelong risk of identity theft due to leaked PII.
• Future financial fraud monitoring case (Expected): Anticipates harm as attackers exploit exposed data for phishing scams.

What Data Was Leaked?

While Coinbase stated that private keys and passwords were not accessed, the attackers obtained:

• Full names and addresses
• Email addresses and phone numbers
• Social Security numbers
• Masked account details
• Transaction histories

Such personally identifiable information (PII) is extremely valuable to cybercriminals, as it can be used for phishing, impersonation, and fraud.

Coinbase Chief Legal Officer Paul Grewal said, "We have notified and are working with the DOJ and other U.S. and international law enforcement agencies and welcome law enforcement’s pursuit of criminal charges against these bad actors."

Coinbase’s Response and Mitigation

In a blog post, Coinbase revealed that the breach began with an extortion attempt and a $20 million ransom demand. The company refused to pay and instead offered a matching bounty for information leading to the attackers’ capture.

Coinbase has earmarked $180 million to $400 million for user reimbursement and remediation efforts, as noted in its SEC filing.

Additional steps taken by Coinbase:

• Terminated implicated support staff in India and referred them for prosecution
• Strengthened internal insider-threat detection systems
• Increased identity checks and scam-awareness prompts
• Established a new U.S.-based customer support hub
• Contacted affected users directly to offer support

Despite these efforts, lawsuits argue that the damage was avoidable. Plaintiff Rosemary Ortiz stated that Coinbase “amplified the breach’s impact by retaining old sensitive data it no longer needed.”

Ongoing Investigations and Industry Impact

Although Coinbase is not currently under DOJ investigation, law enforcement is pursuing charges against the perpetrators.

The breach has also reignited concerns about the crypto industry's reliance on offshore labor and its vulnerability to insider threats.

Coinbase's position remains that it is committed to transparency and user protection. “We’re committed to full transparency,” the company said, reiterating its cooperation with investigators.

In a March interview with Newsmax, the company faced criticism over its handling of security breaches and employee oversight. Despite the reassurances the Coinbase lawsuits and contentious litigation is ongoing.