Crypto Currents: Coinbase reports stolen user data in hack

As bitcoin, ethereum and other cryptocurrencies get increasing attention from investors, Wall Street and its traditional banks continue to adjust to the shift. Catch up on this week’s top stories highlighting the intersection of these old guard and new school areas of finance with this recap compiled by The Fly.

COINBASE REPORTS STOLEN USER DATA: Coinbase (COIN) said in a Thursday regulatory filing that on May 11, it received an email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation, including materials relating to customer-service and account-management systems.

The company said, “The communication demanded money in exchange for not publicly disclosing the information. The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities. These instances of such personnel accessing data without business need were independently detected by the company’s security monitoring in the previous months. Upon discovery, the company immediately terminated the personnel involved, implemented heightened fraud-monitoring protections and warned customers whose information was potentially accessed in order to prevent misuse of any compromised information. Since receipt of the email, the company has assessed the email to be credible and has concluded that these prior instances of improper data access were part of a single campaign that succeeded in taking data from internal systems. The company has not paid the threat actor’s demand and is cooperating with law enforcement in the investigation of this incident. The incident did not involve the compromise of passwords or private keys, and at no time were any of the targeted contractors or employees able to access customer funds. The company is continuing to review and bolster its anti-fraud protections to mitigate the risk that the compromised information could be used in social-engineering attempts.”

The company is also in the process of opening a new support hub in the United States. Based on the information available to the company, Coinbase has preliminarily estimated expenses to be within the range of approximately $180M-$400M relating to remediation costs and voluntary customer reimbursements relating to this incident.

In a blog post following the filing, Coinbase said, “Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks. These insiders abused their access to customer support systems to steal the account data for a small subset of customers. No passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched. We will reimburse customers who were tricked into sending funds to the attacker. We’re cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20M ransom demand we received. Instead we are establishing a $20M reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.”

Additionally on Thursday, The New York Times’ David Yaffe-Bellany and Matthew Goldstein reported that the Securities and Exchange Commission has been investigating whether Coinbase misstated its user numbers in past disclosures in an inquiry that began during the Biden administration and has continued President Trump. The investigation has focused on a metric that Coinbase included in securities filings and marketing materials, claiming that the company had more than 100M “verified users”. The data point appeared in Coinbase’s original public offering document in 2021, but the company stopped citing it two years later. Coinbase has been in touch with the SEC over the course of this year and has hired the law firm Davis Polk & Wardwell to assist with its response.

Following the report, Coinbase’s Chief Legal Officer Paul Grewal was quoted by Reuters as having stated that the SEC investigation is a hold-over from the prior administration about a “metric we stopped reporting 2.5 years ago”. Coinbase “strongly believes” the SEC investigation should not continue and remains “committed to working to bring the matter to a close,” the CLO said.

Oppenheimer kept an Outperform rating and $293 price target on Coinbase on Thursday while noting that the 7.2% selloff in the stock following the cyberattack disclosure and the NYT report is “overdone”. The former impacts the company’s reputation but appears to be an isolated case, and the expected remediation cost of $180M-$400M, while high, intends to send a message that customers’ funds are safe, the analyst said. The latter announcement stems from an old investigation started under the previous administration, the firm added.

Meanwhile, Benchmark raised the firm’s price target on Coinbase to $301 from $252 and kept a Buy rating on the shares. A week that began with Coinbase reaching a major milestone with its addition to the S&P 500 “took a turn for the worse” when the company disclosed a significant cybersecurity breach and confirmed an ongoing SEC investigation, the analyst said. However, while May 15 “will go down as a challenging day for the company,” Benchmark does not believe the negative headlines will obscure its position as “one of the primary beneficiaries of the institutional adoption of crypto,” which the firm expects to accelerate with the emergence of regulatory clarity. The firm’s revised target is based on 25-times the estimate of FY26 EPS of $12.03, the analyst noted.

AMERICAN BITCOIN, GRYPHON ENTER MERGER AGREEMENT: Hut 8 Corp. (HUT) announced Monday that its majority-owned subsidiary, American Bitcoin, has (GRYP), pursuant to which Gryphon will acquire American Bitcoin in a stock-for-stock merger transaction. Upon closing, the combined company will operate under the American Bitcoin brand, led by the American Bitcoin board of directors, including Mike Ho, Asher Genoot, Justin Mateen, and Michael Broukhim, and management team, including Mike Ho, Matt Prusak, and Eric Trump. The combined company is expected to trade on Nasdaq under the ticker symbol “ABTC.” The transaction is expected to close as early as Q3 2025.

“This transaction marks the next step in scaling American Bitcoin as a purpose-built vehicle for low-cost Bitcoin accumulation at scale,” said Asher Genoot, CEO of Hut 8. “By taking American Bitcoin public, we expect to unlock direct access to dedicated growth capital independent of Hut 8’s balance sheet, while preserving long-term exposure to Bitcoin upside for our shareholders.”

Existing stockholders of American Bitcoin are expected to own approximately 98% of the combined company. Immediately following the completion of the transaction, the Company will beneficially own a majority of the issued and outstanding capital stock of the combined company. Following the transaction, Hut 8 will continue to serve as American Bitcoin’s exclusive infrastructure and operations partner through a series of long-term commercial agreements expected to generate stable, contracted revenue streams in Hut 8’s Power and Digital Infrastructure segments.

On Wednesday, B. Riley initiated coverage of Hut 8 with a Buy rating and $25 price target. With operations across Canada and the U.S., Hut 8 provides a diversified platform through its three business lines, the analyst said. The firm expects the company’s growth initiatives over the next 12 months to sustain this diversified approach. This approach enables Hut 8 to capitalize on the growth potential from its colocation business while reducing earnings volatile, contended B. Riley.

CRYPTO EARNINGS: On Monday, Bakkt (BKKT) reported first quarter earnings per share of $1.13 on a revenue of $1.07B, which compared to Q1 loss per share of ($1.86) on a revenue of $854.6M last year. Crypto-enabled accounts grew to 6.8M, up 7.9% year-over-year.

“Bakkt’s evolution into a focused crypto infrastructure company is accelerating with remarkable momentum,” said Andy Main, Co-CEO. “With our planned strategic divestitures of non-core assets and our collaboration with DTR, we’re sharpening our focus on our fundamental crypto strengths while simultaneously enhancing our technological capabilities and reducing operating expenses. Our commercial agreement with DTR, which we are presently negotiating, will unlock access to DTR’s advanced AI frameworks, which we believe will create unprecedented opportunities for product innovation, operational efficiencies, and customer engagement. We’re seeing growing interest from global exchanges, decentralized wallet providers and financial institutions seeking compliant access to next-generation payment solutions. The positive regulatory trajectory in the U.S. for stablecoins, including progress on key legislation like the STABLE Act, combined with major financial and technology companies preparing to enter the space, validates our strategic direction and the timing of our cooperation with DTR as digital payments continue to evolve rapidly.”

On Wednesday, Bitfarms (BITF) reported Q1 loss per share of (7c) on a revenue of $67M, which compared to a loss per share of (2c) for the same period last year and analyst revenue estimates of $64.96M. As of May 13, the company held 1,166 bitcoin.

CEO Ben Gagnon stated, “During the quarter, we executed across several key areas in our strategic pivot to the U.S. and HPC. First, we completely transformed our energy portfolio with the strategic and profitable disposition of one of our Paraguayan Bitcoin mining campus, Yguazu, and the strategic acquisition of two large power campuses in Pennsylvania with the Stronghold acquisition. This materially reduced capex spending on Bitcoin mining and secured two high potential flagship campuses for HPC while further bolstering our liquidity position. Second, we strengthened our management team with two internal HPC/Infrastructure hires and two world-class external HPC/AI partners who are laser focused on developing and scaling our North American HPC/AI business. Lastly, we continued to make strides with our core Bitcoin mining business, growing our EHuM over 50% in the quarter and achieving our efficiency target of 19 w/TH ahead of schedule. The mining business now provides a stable, low-capex and free cash flow foundation for the Company that positions us very well to grow and develop our U.S. assets into HPC/AI data centers while still capitalizing on any potential Bitcoin upside in 2025 and 2026.”

Following the report, H.C. Wainwright reiterated a Buy rating on Bitfarms with a $4 price target, Bitfarms is “rapidly transforming” from an international pure-play bitcoin mining company to a U.S.- focused energy and compute business focused on artificial intelligence data center development while maintaining one of the largest and most efficient mining fleets in the industry, the analyst said. The firm remains bullish on Bitfarms’ bitcoin mining business in 2025, which it said “remains significantly undervalued.”

Additionally, Alliance Global Partners noted Bitfarms reported Q1 revenue of $66.7M, which implies a 33% year-over-year increase and was higher than the firm’s $61.7M estimate. The increase was mainly driven by the increase in average hash rate and average bitcoin price, which was partially offset by the increase in network difficulty and lower bitcoin awards due to the April 2024 halving. Alliance Global also noted the company secured a loan for up to $300M to build out its Panther Creek, Pa. facility for HPC/AI and has received the first tranche for $50M. Panther Creek was chosen as the first HPC/AI site given its 500 MW of energy capacity, proximity to NYC and Philadelphia and fiber in place. The master plan for Panther Creek is expected to be in place by the end of June, which will trigger the remaining $250M, the firm added. Alliance Global reiterated a Buy rating on the shares with a price target of $3.

On Thursday, Bit Digital (BTBT) reported a Q1 loss per share of (32c) on revenue of $25.1M, which compared to EPS of 43c last year and analyst revenue estimates of $26.38M. The company earned 83.3 bitcoins during Q1, an 80% decrease from the prior year. The decline was driven by a reduction in block rewards following the halving event in April 2024, an increase in network difficulty, and a decrease in the company’s average operational hash rate following a fleet deployment.

The company said, “Our first quarter results were affected by mark-to-market losses on digital assets and lower bitcoin mining revenue, both of which reflect industry-wide headwinds and the strategic rebalancing of our business. We continued to make meaningful progress in scaling our infrastructure platform and diversifying our revenue streams.”

CORE SCIENTIFIC INITIATED WITH OUTPERFORM: Oppenheimer initiated coverage of Core Scientific (CORZ) on Wednesday with (CRWV) with a very attractive ten-year contract, whereby CoreWeave puts the CAPX for the datacenter upgrades.

STRATEGY PRICE TARGET RAISE: BTIG raised the firm’s price target on Strategy (MSTR) on Wednesday to $620 from $570 and kept a Buy rating on the shares following the company’s conference. The firm thinks there is a misunderstanding of Strategy’s fixed-income securities in terms of both their risk/reward attributes and their benefits to the common equity. Over time, the fixed-income markets will begin to better understand the risk/reward of Strategy’s fixed-income offerings, which could result in more opportunity to create leverage to the common equity, the analyst said. BTIG points out the price bitcoin has appreciated 12% year-to-date, which has brought Strategy’s bitcoin stockpile to be worth $60B.

CRYPTO STOCK PLAYS: Publicly traded companies in the space include Bit Digital, Coinbase, Core Scientific, Greenidge Generation (GREE), Mara Holdings (MARA), Strategy, Riot Platforms (RIOT) and TeraWulf (WULF).

PRICE ACTION: As of time of writing, bitcoin rose roughly 1% this week to $103,930 in U.S. dollars, according to CoinDesk.