At least five lawsuits have been filed against Coinbase since the breach disclosure.5 However, an incredibly conveniently timed update to Coinbase’s customer terms, announced on April 12 and applying to disputes filed after May 15, may make it more challenging for these cases to succeed. While Coinbase’s customer terms previously contained some text seeking to limit class action lawsuits and force customers into arbitration, the update made some key changes, most significantly aiming to force lawsuits to be filed in New York. The new version also expands clauses limiting collective litigation, mass arbitration, and sharing of information between separate parties involved in arbitration proceedings against Coinbase. It also aims to force any claims that do proceed in court rather than arbitration to go to a bench trial instead of a trial by jury, reduces thresholds triggering batch arbitration, and much more prominently highlights the “Class, Collective, Representative, and Mass Action Waiver and Jury Trial Waiver”.

Of the five lawsuits filed against Coinbase for the data breach thus far, all are class actions, none were filed before May 15, and two were filed outside of New York.
At least five lawsuits have been filed against Coinbase since the breach disclosure.5 However, an incredibly conveniently timed update to Coinbase’s customer terms, announced on April 12 and applying to disputes filed after May 15, may make it more challenging for these cases to succeed. While Coinbase’s customer terms previously contained some text seeking to limit class action lawsuits and force customers into arbitration, the update made some key changes, most significantly aiming to force lawsuits to be filed in New York. The new version also expands clauses limiting collective litigation, mass arbitration, and sharing of information between separate parties involved in arbitration proceedings against Coinbase. It also aims to force any claims that do proceed in court rather than arbitration to go to a bench trial instead of a trial by jury, reduces thresholds triggering batch arbitration, and much more prominently highlights the “Class, Collective, Representative, and Mass Action Waiver and Jury Trial Waiver”. Of the five lawsuits filed against Coinbase for the data breach thus far, all are class actions, none were filed before May 15, and two were filed outside of New York.
According to Coinbase, the data thieves bribed some members of Coinbase’s poorly paid offshore customer support team, who they described as “rogue overseas support agents”, who are reportedly earning less than $5,000 annually.2 Coinbase’s cybersecurity disclosure filing with the SEC admitted that they had been grappling with this issue for months: “The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities. These instances of such personnel accessing data without business need were independently detected by the Company’s security monitoring in the previous months.”3 Bloomberg later reported that “the hackers did have near-constant access to some of Coinbase Global Inc.’s most valuable customer data since January”, citing an anonymous source familiar with the incident.4
According to Coinbase, the data thieves bribed some members of Coinbase’s poorly paid offshore customer support team, who they described as “rogue overseas support agents”, who are reportedly earning less than $5,000 annually.2 Coinbase’s cybersecurity disclosure filing with the SEC admitted that they had been grappling with this issue for months: “The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities. These instances of such personnel accessing data without business need were independently detected by the Company’s security monitoring in the previous months.”3 Bloomberg later reported that “the hackers did have near-constant access to some of Coinbase Global Inc.’s most valuable customer data since January”, citing an anonymous source familiar with the incident.4
Coinbase
On May 12, Coinbase announced it will join the S&P 500 as its “first and only crypto company”.1a This is the latest change that may see more American investors inadvertently exposed to the cryptocurrency industry via index funds, following MicroStrategy’s entry into the NASDAQ-100 in December 2024 [I72].

Their joy was likely tempered when, only two days later on May 14, they had to announce a data breach that exposed customer data including names, addresses, phone numbers, email addresses, images of government ID documents, account balance and transaction data, and masked social security and bank account numbers. Although leaks like this typically lead to an uptick in phishing attempts, where scammers use the private information to contact customers and more convincingly impersonate Coinbase employees, the leak of account balance data and customer addresses is also particularly concerning given the recent spike in violent attacks and kidnappings targeting wealthy crypto holders.

Crypto security researchers have been warning for months about Coinbase’s evidently poor security practices and lack of attention to customer complaints, and describing hacks in which victims reported being scammed by attackers who seemed to have access to private Coinbase data [I76]. In February, zachxbt wrote: “Coinbase needs to urgently make changes as more and more users are being scammed for tens of millions every month. ... Coinbase is in a position where they have the power to make
Coinbase On May 12, Coinbase announced it will join the S&P 500 as its “first and only crypto company”.1a This is the latest change that may see more American investors inadvertently exposed to the cryptocurrency industry via index funds, following MicroStrategy’s entry into the NASDAQ-100 in December 2024 [I72]. Their joy was likely tempered when, only two days later on May 14, they had to announce a data breach that exposed customer data including names, addresses, phone numbers, email addresses, images of government ID documents, account balance and transaction data, and masked social security and bank account numbers. Although leaks like this typically lead to an uptick in phishing attempts, where scammers use the private information to contact customers and more convincingly impersonate Coinbase employees, the leak of account balance data and customer addresses is also particularly concerning given the recent spike in violent attacks and kidnappings targeting wealthy crypto holders. Crypto security researchers have been warning for months about Coinbase’s evidently poor security practices and lack of attention to customer complaints, and describing hacks in which victims reported being scammed by attackers who seemed to have access to private Coinbase data [I76]. In February, zachxbt wrote: “Coinbase needs to urgently make changes as more and more users are being scammed for tens of millions every month. ... Coinbase is in a position where they have the power to make
Tweet by Brian Armstrong: We started notifying users about this on April 11th, so it had nothing to do with the data breach. You’re giving us far too much credit in your conspiracy theory. The class action waiver has always been in our arbitration agreement btw, so this change (amongst many others) just made the user terms consistent.
2:41 PM · May 20, 2025

Reply by Molly White: It did more than “make the user terms consistent” — the clause forcing litigation in New York is entirely new, for example.
Screenshot of text: "While Coinbase’s customer terms previously contained some text seeking to limit class action lawsuits and force customers into arbitration, the update made some key changes, most significantly aiming to force lawsuits to be filed in New York. The new version also expands clauses limiting collective litigation, mass arbitration, and sharing of information between separate parties involved in arbitration proceedings against Coinbase. It also aims to force any claims that do proceed in court rather than arbitration to go to a bench trial instead of a trial by jury, reduces thresholds triggering batch arbitration, and much more prominently highlights the 'Class, Collective, Representative, and Mass Action Waiver and Jury Trial Waiver'."

Reply by Molly White: And if you knew about the data breach as far back as at least April 11 (or much further, according to outside reporting from Bloomberg), why did it take you another month to disclose with the SEC?
Tweet by Brian Armstrong: We started notifying users about this on April 11th, so it had nothing to do with the data breach. You’re giving us far too much credit in your conspiracy theory. The class action waiver has always been in our arbitration agreement btw, so this change (amongst many others) just made the user terms consistent. 2:41 PM · May 20, 2025 Reply by Molly White: It did more than “make the user terms consistent” — the clause forcing litigation in New York is entirely new, for example. Screenshot of text: "While Coinbase’s customer terms previously contained some text seeking to limit class action lawsuits and force customers into arbitration, the update made some key changes, most significantly aiming to force lawsuits to be filed in New York. The new version also expands clauses limiting collective litigation, mass arbitration, and sharing of information between separate parties involved in arbitration proceedings against Coinbase. It also aims to force any claims that do proceed in court rather than arbitration to go to a bench trial instead of a trial by jury, reduces thresholds triggering batch arbitration, and much more prominently highlights the 'Class, Collective, Representative, and Mass Action Waiver and Jury Trial Waiver'." Reply by Molly White: And if you knew about the data breach as far back as at least April 11 (or much further, according to outside reporting from Bloomberg), why did it take you another month to disclose with the SEC?
Coinbase CEO Brian Armstrong responded to my reporting on this timing to describe it as a “conspiracy theory”, claiming that customers were being notified before the user agreement change, and that the change merely “made the user terms consistent”.6

He did not immediately respond to a clarification that the change was much more substantial than he described, including the entirely new forum clause. He also did not respond to a question asking why it took Coinbase more than a month to disclose the breach to the SEC (per his admission; more, if Bloomberg’s reporting is accurate), when such disclosures are required within four business days of companies discovering material cybersecurity incidents.7
Coinbase CEO Brian Armstrong responded to my reporting on this timing to describe it as a “conspiracy theory”, claiming that customers were being notified before the user agreement change, and that the change merely “made the user terms consistent”.6 He did not immediately respond to a clarification that the change was much more substantial than he described, including the entirely new forum clause. He also did not respond to a question asking why it took Coinbase more than a month to disclose the breach to the SEC (per his admission; more, if Bloomberg’s reporting is accurate), when such disclosures are required within four business days of companies discovering material cybersecurity incidents.7
In government
The GENIUS Act stablecoin bill has already advanced in the Senate, after all Democrats and several Republicans voted against it less than two weeks ago amid concerns about Trump’s serious crypto conflicts of interest [I83]. Some Democrats tried to insist that any stablecoin bill include explicit prohibitions preventing the president, Congress members, and others in government from creating and selling digital assets; others, such as the bill’s co-sponsor and longtime crypto industry ally Kirsten Gillibrand, argued that Trump’s crypto activities are “already illegal” and that the bill shouldn’t “deal with all of President Trump’s ethics problems”.20

Despite little in the way of acquiescence to Democrats’ requested changes, 16 Democrats voted in support of the cloture motion: Alsobrooks (MD), Blunt Rochester (DE), Booker (NJ), Cortez Masto (NV), Fetterman (PA), Gallego (AZ), Gillibrand (NY), Hassan (NH), Heinrich (NM), Lujan (NM), Ossoff (GA), Padilla (CA), Rosen (NV), Schiff (CA), Slotkin (MI), Warner (VA).21 The bill will now go to a full vote, likely this week, and will likely still pass after a symbolic but unsuccessful vote on an amendment to limit Trump’s crypto involvement.

The breakneck pace of this bill is likely due to the crypto industry’s concern that their influence on Congress might diminish after the midterm elections. “We have a very narrow window to get legislation through. The midterms are next year. I think it’s very
In government The GENIUS Act stablecoin bill has already advanced in the Senate, after all Democrats and several Republicans voted against it less than two weeks ago amid concerns about Trump’s serious crypto conflicts of interest [I83]. Some Democrats tried to insist that any stablecoin bill include explicit prohibitions preventing the president, Congress members, and others in government from creating and selling digital assets; others, such as the bill’s co-sponsor and longtime crypto industry ally Kirsten Gillibrand, argued that Trump’s crypto activities are “already illegal” and that the bill shouldn’t “deal with all of President Trump’s ethics problems”.20 Despite little in the way of acquiescence to Democrats’ requested changes, 16 Democrats voted in support of the cloture motion: Alsobrooks (MD), Blunt Rochester (DE), Booker (NJ), Cortez Masto (NV), Fetterman (PA), Gallego (AZ), Gillibrand (NY), Hassan (NH), Heinrich (NM), Lujan (NM), Ossoff (GA), Padilla (CA), Rosen (NV), Schiff (CA), Slotkin (MI), Warner (VA).21 The bill will now go to a full vote, likely this week, and will likely still pass after a symbolic but unsuccessful vote on an amendment to limit Trump’s crypto involvement. The breakneck pace of this bill is likely due to the crypto industry’s concern that their influence on Congress might diminish after the midterm elections. “We have a very narrow window to get legislation through. The midterms are next year. I think it’s very
Trump business interests
Trump’s memecoin dinner is coming up on May 22. As of the final count, 72% of the wallets on the leaderboard are likely controlled by entities outside the US. The top holder is still an HTX hot wallet likely representing Justin Sun, who has yet to publicly confirm he’s attending the dinner, but who just so happened to show up in the US on May 19.

Tweet by Justin Sun: “Excited to be back in the🇺🇸!  Where should I visit next? Let me know👇”
(Tweet)
The leaderboard was finalized ten days before the dinner, presumably to give Trump’s team time to perform background checks on guests. This allowed those who purchased $TRUMP tokens solely to secure a dinner invite to dump the tokens, and many have, despite the Trump team’s attempts to thwart a selloff by announcing a “Very Special and Rare” “TRUMP DIAMOND HAND limited edition TRUMP SOLANA NFT” for any dinner attendees still holding their tokens by the time of the dinner.14
Trump business interests Trump’s memecoin dinner is coming up on May 22. As of the final count, 72% of the wallets on the leaderboard are likely controlled by entities outside the US. The top holder is still an HTX hot wallet likely representing Justin Sun, who has yet to publicly confirm he’s attending the dinner, but who just so happened to show up in the US on May 19. Tweet by Justin Sun: “Excited to be back in the🇺🇸! Where should I visit next? Let me know👇” (Tweet) The leaderboard was finalized ten days before the dinner, presumably to give Trump’s team time to perform background checks on guests. This allowed those who purchased $TRUMP tokens solely to secure a dinner invite to dump the tokens, and many have, despite the Trump team’s attempts to thwart a selloff by announcing a “Very Special and Rare” “TRUMP DIAMOND HAND limited edition TRUMP SOLANA NFT” for any dinner attendees still holding their tokens by the time of the dinner.14
David Bailey, a close Trump crypto adviser who runs Bitcoin Magazine and the annual Bitcoin conference where Trump debuted as “crypto president,” is following in the footsteps of others close to Trump, including Trump’s sons and Brandon Lutnick, son of Commerce Secretary Howard Lutnick. Bailey’s new company, Nakamoto, is following the same rough blueprint as the Trump sons’ American Bitcoin and Lutnick’s Twenty One Capital: create a new company, merge it with an existing public company or SPAC,b and accumulate bitcoin to become a bitcoin proxy bet.c Bailey, the Trump sons, and Lutnick are themselves following a playbook established by Michael Saylor and his MicroStrategy company (now just Strategy). The MicroStrategy technique has been criticized as both a bubble16 and a Ponzi scheme17 likely to collapse if bitcoin prices fail to go up forever. Good thing that never happens in crypto. Now, however, with the president’s family members, close advisers, and family members of others in the administration all running businesses that depend on bitcoin prices rising, there are even more conflicts of interest incentivizing Trump and others in the government to try to bolster the crypto industry and crypto prices.
David Bailey, a close Trump crypto adviser who runs Bitcoin Magazine and the annual Bitcoin conference where Trump debuted as “crypto president,” is following in the footsteps of others close to Trump, including Trump’s sons and Brandon Lutnick, son of Commerce Secretary Howard Lutnick. Bailey’s new company, Nakamoto, is following the same rough blueprint as the Trump sons’ American Bitcoin and Lutnick’s Twenty One Capital: create a new company, merge it with an existing public company or SPAC,b and accumulate bitcoin to become a bitcoin proxy bet.c Bailey, the Trump sons, and Lutnick are themselves following a playbook established by Michael Saylor and his MicroStrategy company (now just Strategy). The MicroStrategy technique has been criticized as both a bubble16 and a Ponzi scheme17 likely to collapse if bitcoin prices fail to go up forever. Good thing that never happens in crypto. Now, however, with the president’s family members, close advisers, and family members of others in the administration all running businesses that depend on bitcoin prices rising, there are even more conflicts of interest incentivizing Trump and others in the government to try to bolster the crypto industry and crypto prices.