Coinbase Faces Legal Heat Over 4-Month Delay in Disclosing $400M Security Breach

When trust costs $400 million—and four months of silence.

The breach that wasn’t a blip

Coinbase users just learned their data was compromised in a massive breach... four months after the fact. The exchange reportedly waited until June 2025 to notify affected clients about the January incident—conveniently bypassing earnings season. Classic ’ask forgiveness, not permission’ banking logic—except this isn’t legacy finance, folks.

Regulators sharpen knives

State attorneys general are already circling, with potential violations of data breach notification laws. Most US states require disclosure within 30-60 days. That $400 million hole? Suddenly looks cheaper than the coming legal bills.

The cynical take

Nothing boosts crypto adoption like reminding users their fiat-era protections don’t apply. Who needs FDIC insurance when you’ve got ’innovative incident response timelines’?

Coinbase Facing Legal Action for Delayed Notification of Major Data Breach

It has been a massive few months for the Coinbase cryptocurrency exchange. In what is a major achievement for the company, it entered the S&P 500 for the very first time. The landmark development was a key win for the cryptocurrency sector. Moreover, it established the exchange as one of the premiere crypto firms on the planet.

However, it is facing increased scrutiny over a new report that has many questioning its security measures. Specifically, Coinbase is set to face legal action after it waited 4 months to alert its users of a $400 million security breach. Indeed, the company was alerted of compromised data in January of 2025 while not alerting nearly 70,000 users until May 14th.

The delayed warning notified investors that the breach could cost anywhere between $180 million and $400 million. In response, they are said to have cut access to contractors while noting misconduct. Moreover, they have committed to enhancing third-party vendor controls.

The exchange could still find itself in major trouble with US regulatory bodies. The US Securities and Exchange Commission (SEC) has strict reporting standards when it comes to data breaches. According to its cyber-incident rule, an 8-K must be filed within eight days of the event.

Coinbase filed the necessary report in May, noting “prior months” of potential data compromises. However, they did not clarify that email correspondence showed the breach took place in January.