Lawsuit: Lax Coinbase cybersecurity led to theft of customers’ crypto

Coinbase charged significant fees to customers to safeguard their accounts, but it did not protect them from their assets being stolen, according to the lawsuit, filed in U.S. District Court for the Northern District of California on Tuesday. Coinbase holds cryptocurrency assets for customers and provides a platform through which crypto is traded.

Coinbase is the largest cryptocurrency exchange in the United States, with 98 million verified users and billions in customer assets, according to the lawsuit. It handles trades totaling more than $309 billion a quarter. Coinbase and Coinbase Global violated the federal Electronic Fund Transfer Act as well as California law, the lawsuit alleged.

One of those claiming harm by poor security at Coinbase was Manish Aggarwal, lead plaintiff in the lawsuit, who had $190,000 stolen out of his cryptocurrency accounts in April. The company has refused to repay Aggarwal, his attorneys at Braunhagey & Borden alleged.

Coinbase ads said it provided “best in class storage” for digital assets, with “industry-leading security,” including encryption, the lawsuit said. The company claimed on its website it had “never been hacked.”

However, in spring 2021, customer assets were stolen during a security breach that exploited a vulnerability Coinbase knew about, and 6,000 customers were impacted, the lawsuit stated. Coinbase misrepresented after the breach it fixed its security problems because customer accounts through at least July 2022 had been stolen from, the lawsuit claimed.

The company’s customer service also did little to assist customers whose accounts were stolen, contrary to representations on its website, the lawsuit said. Aggarwal claimed he tried to reach Coinbase customer service following the hack, but he was repeatedly shunted to a recorded message.

Aggarwal and other plaintiffs are seeking restitution, damages, fees, and other relief, according to the lawsuit.