By Anita Hamilton and Nate Wolf

After popping earlier in the week on news it was joining the S&P 500, shares of crypto exchange Coinbase were down around 6% Thursday on two pieces of bad news.

First it reported that it was the victim of a data breach that could cost between $180 million and $400 million for "remediation costs and voluntary customer reimbursements."

Then on Thursday afternoon, the New York Times reported on a Securities and Exchange Commission investigation into possible misrepresentation of its user numbers.

The SEC declined to comment on the investigation, but Coinbase told Barron's in an email, "this is a hold-over investigation from the prior administration about a metric we stopped reporting two and a half years ago, which was fully disclosed to the public."

"We remain committed to working with the SEC to bring this matter to a close," Paul Grewal, Coinbase's chief legal officer, said.

Shares were trading around $248 Thursday afternoon. They had previously closed up 24% at $257 on Tuesday, the day after it was announced that Coinbase would join the S&P 500. They are currently up 24% over the last 52 weeks on optimism for less crypto industry regulation from President Donald Trump, who has dubbed himself the "crypto president."

The ransomware cyberattack began on Sunday, May 11, when Coinbase got a message from "an unknown threat actor" claiming to have internal corporate materials and information about some customer accounts.

Breached data included names and contact information, partial Social Security and bank-account identifiers, government identification images, and some corporate and account data. No customer passwords, private keys or funds were accessed, according to Coinbase's filing.

The alleged cyberattacker demanded money and appeared to have paid multiple Coinbase employees and contractors outside the U.S. to obtain the files, the company said.

Coinbase said it fired the workers involved and said it hasn't paid the attacker. But the indirect costs could still add up.

"As the Company's investigation is ongoing, the full impact of these events are not yet known," the filing said, adding that law enforcement was investigating the incident.

The breach is a sour note during an eventful week for the crypto exchange. The announcement that Coinbase would join the S&P 500 index was a landmark moment for the crypto industry as it marks the first crypto company to do so.

Write to Anita Hamilton at anita.hamilton@barrons.com and Nate Wolf at nate.wolf@barrons.com

This content was created by Barron's, which is operated by Dow Jones & Co. Barron's is published independently from Dow Jones Newswires and The Wall Street Journal.

(END) Dow Jones Newswires

May 15, 2025 15:15 ET (19:15 GMT)

Copyright (c) 2025 Dow Jones & Company, Inc.