Coinbase Hit With Lawsuits Over Data Breach and Stock Drop

The 2025 Coinbase data breach has produced two main lines of litigation: a consolidated class action in the Southern District of New York brought by the roughly 69,461 customers whose personal data was stolen, and a separate securities fraud class action in New Jersey brought by investors. A third suit targets TaskUs, the outsourcing firm whose employees were bribed to steal the data. All three remain active in 2026, and no settlement has been reported in any of them.¹²

Who Was Affected and What Was Stolen

The breach hit roughly 69,461 Coinbase customers. Cybercriminals bribed customer support contractors working at outsourced call centers in India, paying them to copy data from Coinbase’s internal support tools. The stolen information included names, addresses, phone numbers, email addresses, masked Social Security numbers, partial bank account details, government ID images such as passports and driver’s licenses, and account data including balance snapshots and transaction histories.³ Login credentials, two-factor authentication codes, and private keys were not compromised.⁴

The stolen data was then used to impersonate Coinbase employees by phone and trick victims into transferring cryptocurrency to attacker-controlled wallets.⁵ Documented individual losses ran into hundreds of thousands of dollars; one victim lost approximately $850,000, with stolen funds traced to a consolidation address linked to more than 25 other victims.⁶ Those losses form the backbone of the damages claims.

The Consolidated Class Action Against Coinbase

The first customer suit, Shakib v. Coinbase, was filed on May 29, 2025, in the Northern District of California. It asserts claims of negligence, breach of implied contract, and unjust enrichment on behalf of the affected customers, and seeks statutory, punitive, and monetary damages, including compensation for stolen cryptocurrency, identity theft costs, lost account access, and time spent mitigating harm.⁷

The Judicial Panel on Multidistrict Litigation then transferred the various data breach cases into a single proceeding, In re Coinbase Customer Data Security Breach Litigation, Case No. 1:25-md-03153, in the Southern District of New York before Judge Edgardo Ramos.¹

At a September 2025 status conference, Judge Ramos set the schedule. The consolidated amended complaint was due within 45 days. Coinbase’s motion to compel arbitration was due 45 days after that, with limited discovery on arbitrability to follow. Competing motions for interim class counsel were also filed. As of May 2026, the case remains active with ongoing procedural filings, and no ruling on the arbitration motion or class counsel appointment has been publicly recorded on the docket.¹

Why the Arbitration Fight Matters

Coinbase’s user agreement contains a mandatory individual arbitration clause, and the company has moved to push breach-related lawsuits out of court and into arbitration.⁸ If the court grants that motion, the consolidated class action would break apart into thousands of individual arbitration proceedings rather than proceeding as a single class case.

The clause has held up before. In Kattula v. Coinbase Global, Inc., a 2023 federal court ruling in Georgia found the arbitration agreement enforceable and rejected challenges based on unconscionability and illusory-promise theories, noting users could not access the platform without accepting the terms.¹ But the U.S. Supreme Court’s unanimous 2024 decision in Coinbase, Inc. v. Suski held that when two contracts conflict on arbitrability, a judge rather than an arbitrator must decide which contract controls.⁹ How the MDL court resolves the arbitration question is the pivot point for every class member.

The Separate Case Against TaskUs

A separate class action, Estrada v. TaskUs, Inc., was filed on May 27, 2025, in the Southern District of New York, targeting the outsourcing firm directly. It alleges TaskUs negligently failed to protect the personal information of affected users.¹⁰ An amended complaint added several plaintiffs in September 2025.¹¹

The amended complaint accuses TaskUs of a “pattern of concealment,” alleging the data theft began as early as September 2024, that TaskUs fired 226 staff in January 2025, and that it disbanded its internal HR investigation team in February 2025. TaskUs has moved to dismiss and to block inclusion of the case in the broader consolidated proceeding.⁸ TaskUs has said it fired two employees for illegally accessing client information and immediately reported the activity to Coinbase.¹²

The Securities Fraud Case

Investors have their own case, but it is not primarily about the 2025 breach. In re Coinbase Global, Inc., Securities Litigation, Case No. 2:22-cv-04915, is pending in the District of New Jersey. Plaintiffs allege violations of Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, and Sections 11, 12(a)(2), and 15 of the Securities Act of 1933.²

The core allegations predate the 2025 breach. Originally filed in August 2022 as Patel v. Coinbase Global, Inc., the suit claims Coinbase and its executives made materially false or misleading statements leading up to the company’s April 2021 direct listing on the Nasdaq. Plaintiffs allege the company failed to disclose that customer crypto assets held in custody could be treated as part of the bankruptcy estate in a potential bankruptcy, and that the SEC was investigating whether the platform allowed trading of unregistered securities.¹³ A third amended complaint was filed in October 2025, with lead plaintiffs including Sjunde AP-Fonden, a Swedish pension fund.²

The 2025 breach is relevant to that case only as context. When Coinbase disclosed the incident on May 14, 2025, its stock fell roughly 7.8% the next day, closing at $195.43 on May 15, 2025, down from $212.01 the prior session. By June 5 the stock hit a low of around $152, a drop of more than 28% from pre-disclosure levels.¹⁴ Whether the breach disclosure timing becomes part of the securities theory in a future amendment has not been publicly resolved.

What Coinbase Has Paid So Far

In its May 14, 2025 SEC filing, Coinbase estimated the incident would cost between $180 million and $400 million in remediation and voluntary customer reimbursements.¹⁵ The company pledged to reimburse retail customers tricked into sending funds to attackers through social engineering, subject to a case-by-case review.⁵ Coinbase’s May 2026 quarterly filing reports ongoing costs for voluntary customer reimbursements, direct legal expenses, and potential reward-related payments tied to its $20 million bounty program, tracked as a separate line item, “Data Theft Incident losses, net.”

The reimbursement program runs alongside the litigation, not in place of it. Customers who accept a voluntary reimbursement have not necessarily released their claims in the MDL, and the class definition in Shakib and the consolidated case still covers the full pool of roughly 69,461 affected users.⁷

What to Watch Next

The next meaningful ruling is on Coinbase’s motion to compel arbitration in the New York MDL. If it succeeds, class members would need to pursue individual arbitration claims. If it fails, the consolidated case moves toward class certification. The Estrada v. TaskUs case is on its own procedural track pending the motion to dismiss and the fight over whether it joins the MDL. The New Jersey securities case, now on its third amended complaint, continues separately. On the criminal side, Indian authorities arrested one former Coinbase customer service agent in Hyderabad in late December 2025, and no arrests of the external cybercriminals who orchestrated the bribery and extortion have been publicly reported.¹⁶

1
CourtListener. In Re Coinbase Customer Data Security Breach Litigation
2
Kessler Topaz. Coinbase Global, Inc. Securities Litigation
3
The Hacker News. Coinbase Agents Bribed, Data of 1% Users Stolen
4
Bitdefender. Criminals Bribed Coinbase Support Staff
5
Coinbase. Protecting Our Customers, Standing Up to Extortionists
6
SecureLogix. Coinbase Users Lose $300M to Social Engineering
7
Milberg. Coinbase Data Breach Class Action Lawsuit
8
Fortune. Coinbase Hack TaskUs Indore India
9
Justia. Coinbase, Inc. v. Suski, 602 U.S. (2024)
10
Bloomberg Law. TaskUs Employees Responsible for Coinbase Data Breach, Suit Says
11
CourtListener. Estrada v. TaskUs, Inc.
12
Reuters. Coinbase Breach Linked to Customer Data Leak in India
13
ClassAction.org. Securities Class Action Claims Coinbase Misled Investors Prior to Stock Listing
14
Stock Analysis. COIN Stock Price History
15
The Block. Coinbase Estimates $180M to $400M in Costs Tied to Customer Data Breach
16
Yahoo Finance. India Arrests Former Coinbase Support Agent