Coinbase Lawsuits: Data Breach Class Action, State Suits and the Dropped SEC Case
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
As of September 30, 2026 there is no Coinbase class action settlement, no claim form and no deadline. The Coinbase lawsuit most customers mean is the proposed class action over the 2025 data theft, in which, Coinbase says, criminals paid overseas support staff to copy customer records. It is still being fought in court. Separately, New York's Attorney General is suing a Coinbase unit over its prediction markets, a securities class action was mostly thrown out in July 2026, and the SEC dropped its case in 2025. Each is laid out below.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
The 2025 Data Theft: What Coinbase Disclosed
On May 11, 2025, Coinbase received an email from an unknown party claiming to hold customer data and internal documents and demanding money to keep them private. In an SEC filing on May 15, 2025, Coinbase said the attacker appears to have obtained the data “by paying multiple contractors or employees working in support roles outside the United States.” Coinbase put the affected group at less than 1% of its monthly transacting users, refused a $20 million ransom demand and set up a $20 million reward fund instead.
What was taken, per the filing: name, address, phone and email; the last four digits of the Social Security number; masked bank-account numbers; government-ID images such as driver's licenses and passports; and balance snapshots and transaction history. Passwords and private keys were not compromised, and the insiders could not move customer funds. Coinbase's own description of the motive is the part that matters for customers: the goal was “a customer list they could contact while pretending to be Coinbase.” Coinbase estimated $180 million to $400 million in remediation costs and voluntary customer reimbursements.
The lawsuits allege Coinbase failed to protect that data; one early complaint pleads negligence, breach of implied contract and unjust enrichment. The customer class action also alleges that cybercriminals bribed call-center employees of TaskUs, Coinbase's customer-service provider, in India. These are allegations, not findings.
Case Details
Data breach class action. A complaint was filed in the U.S. District Court for the Northern District of California on May 15, 2025, the day Coinbase disclosed the theft, according to the law firm that filed it; more suits followed. On July 29, 2026, Bloomberg Law reported that TaskUs must defend claims of negligence and unfair and deceptive practices. It is still a proposed class action: no class has been certified and nothing has been settled.
Underwood et al. v. Coinbase Global, Inc. (S.D.N.Y., filed October 2021) is a purported class action under the federal Securities Act and state statutes. The Second Circuit revived those claims on April 5, 2024. On July 30, 2026, the court granted Coinbase summary judgment on all claims relating to the majority of transactions at issue; the surviving subset goes to further discovery. A separate investor suit over Coinbase's direct listing was voluntarily dismissed in March 2025.
SEC v. Coinbase, Inc. The SEC sued in June 2023 in the Southern District of New York, alleging Coinbase operated as an unregistered exchange, broker and clearing agency and sold unregistered securities through staking. On February 27, 2025, the SEC announced a joint stipulation to dismiss, and the case ended with prejudice. A dismissal is not a settlement: there is no fund and nothing to claim.
New York prediction markets. On April 21, 2026, the New York Attorney General sued Coinbase Financial Markets, Inc., alleging its prediction markets are an unlicensed gambling operation. Similar fights are under way elsewhere: news reports describe a Wisconsin suit filed in April 2026 against Coinbase and other platforms, and Bloomberg Law reported on September 21, 2026 that Coinbase would stop offering sports wagering in Michigan amid a suit.
Other state and regulator actions. In June 2023, securities regulators in ten states acted against Coinbase's staking service; five dismissed or withdrew their actions in March and April 2025. Oregon's Attorney General filed a state securities suit in April 2025, according to news reports, which Coinbase has challenged. Earlier, on January 4, 2023, New York's Department of Financial Services announced a $100 million settlement over anti-money-laundering failures: a $50 million penalty paid to the state plus $50 million in compliance spending. None of these is a consumer claims process.
Status: Several Active Cases, No Settlement
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Could Be Included
Data breach. That complaint proposes a nationwide class of U.S. residents impacted by the breach, including everyone Coinbase notified. Coinbase says every affected customer was emailed from no-reply@info.coinbase.com at 7:20 a.m. ET on May 15, 2025 — if you never got that email, Coinbase's position is that your data was not accessed. You do not sign up for a proposed class action; if a class is certified or a settlement is reached, an administrator contacts class members.
Underwood. A purported class action by Coinbase customers. Whether you fall within it depends on the transactions at issue, and after July 30, 2026 only a subset of them remains in the case.
New York prediction markets. The state asks for restitution to consumers who were harmed. Money would reach New York users only if the court orders it, and there is nothing to file.
Is There Any Money for Customers?
If the breach class action ends in a settlement, comparable cases have generally combined reimbursement of documented losses with a smaller flat payment — our data breach settlement calculator shows typical ranges. That is context, not a prediction. New York's case asks for restitution, but no court has ordered any.
Coinbase Lawsuit Timeline
- 1
June 2023 — SEC and States Move In
The SEC sues in the Southern District of New York over Coinbase's exchange and staking business. Securities regulators in ten states act against its staking service the same month.
- 2
February 27, 2025 — SEC Drops Its Case
The SEC announces a joint stipulation to dismiss, citing its new Crypto Task Force and stressing the decision was not based on the merits. The case ends with prejudice.
- 3
May 11–15, 2025 — Extortion Email and Disclosure
Coinbase receives a ransom demand, refuses to pay, files an 8-K on May 15 and emails affected customers. A class action is filed the same day in the Northern District of California.
- 4
April 21, 2026 — New York Sues Over Prediction Markets
The Attorney General sues Coinbase Financial Markets, Inc., calling its prediction markets unlicensed gambling, and seeks restitution for consumers.
- 5
July 2026 — Two Rulings
Bloomberg Law reports on July 29 that TaskUs must defend negligence and deceptive-practice claims in the breach case. On July 30, the Underwood court grants Coinbase summary judgment on claims tied to most transactions.
- 6
Now — No Settlement, No Claim Form
As of September 30, 2026, none of these cases has a settlement, a claims administrator or a deadline.
Three Things to Watch For
Coinbase itself said the thieves wanted a list of customers to call while posing as Coinbase. Watch for:
“Move your crypto to a safe wallet”
Coinbase says it will never ask for your password or 2FA codes, never ask you to move assets to a new address or wallet, and never call or text you with a new seed phrase. If a caller does, hang up.
A caller who already knows your balance
The stolen records included ID images, the last four Social Security digits, balance snapshots and transaction history. A caller who recites them has proved nothing — that is exactly what was taken. Coinbase also says it will never ask you to call an unknown number to reach it.
“Coinbase settlement” or refund forms
No court has approved any Coinbase settlement, so there is no claims portal. A page asking for your Coinbase login, 2FA code or seed phrase to “release your payout” is phishing. Coinbase's real breach notices came from no-reply@info.coinbase.com.
Coinbase Lawsuit — Questions People Actually Ask
Is there a Coinbase class action settlement I can claim?
No. As of September 30, 2026, none of the Coinbase lawsuits — the data breach class action, Underwood or New York's prediction-market case — has a settlement, fund, administrator, claim form or deadline. For settlements that are open now, see open class action settlements.
How do I know if I was in the 2025 Coinbase data breach?
Coinbase says every affected customer got an email from no-reply@info.coinbase.com, sent at 7:20 a.m. ET on May 15, 2025, and put the group at less than 1% of its monthly transacting users. Keep that email: it is your proof if a class is ever certified.
What information was stolen?
Per Coinbase's SEC filing: name, address, phone and email; the last four digits of the Social Security number; masked bank-account numbers and some bank identifiers; government-ID images; balance snapshots and transaction history; and some internal documents. Not passwords or private keys, and no one could move funds with it.
Will Coinbase pay me back if I was scammed?
Coinbase said it would voluntarily reimburse retail customers who mistakenly sent funds to the scammers as a direct result of this incident before its May 2025 announcement, after reviewing the facts. That is Coinbase's own program, not a court settlement, and the promise covered funds sent before that date.
Why did the SEC drop its lawsuit against Coinbase?
The SEC said on February 27, 2025 that it was dismissing the case given the work of its new Crypto Task Force, and that the decision did not rest “on any assessment of the merits.” The case was dismissed with prejudice. It never produced money for customers.
What is New York's lawsuit against Coinbase about?
Filed April 21, 2026 against Coinbase Financial Markets, Inc., it alleges Coinbase's prediction markets are unlicensed gambling in New York, open to users aged 18 to 20 although mobile sports betting requires age 21, and that they allow bets on games involving New York college teams. The state wants profits forfeited, restitution for harmed consumers and fines of three times the profits. Consumers have nothing to file.
Can I sue Coinbase in court, or do I have to use arbitration?
Coinbase's user agreement has contained an arbitration agreement, and a fight over it reached the Supreme Court. In Coinbase, Inc. v. Suski (May 2024), a unanimous Court held that where two contracts conflict on who decides arbitrability, a court decides which contract governs. Whether your own claim belongs in court or in arbitration depends on the terms you accepted — an attorney can read them with you.
What is worth doing right now?
Treat any unexpected call, text or email about your Coinbase account as a scam until proven otherwise, and reach Coinbase only through its app or website. Coinbase recommends withdrawal allow-listing and hardware security keys for 2FA. Because ID images and partial Social Security numbers were taken, a free credit freeze at the three bureaus is a sensible extra step. Keep your May 2025 notice.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Robinhood Lawsuit
Lawsuits and settlements involving the Robinhood trading app
Data Breach Settlement Calculator
Estimate what a data breach settlement typically pays
Open Class Action Settlements
Settlements you can still file a claim for
Class Action Payout Calculator
How claim rates change your per-person payout