Cybersecurity Policy Report, E.D. Pa.: Coinbase misrepresented cybersecurity compliance, but without scienter, (Oct 22, 2026)

By Anne Sherry, J.D.

The company may have known that a breach had already happened while it was still warning of risks.

A fraud complaint against Coinbase identified two misleading statements but faltered on scienter and loss-causation grounds. While most of the challenged statements about Coinbase’s regulatory compliance amounted to puffery or opinion, the company’s SEC filings warned of cybersecurity risks that, according to a news article, had already come to pass. Still, the failure to prove scienter or loss causation was fatal to the entire complaint (Castle v. Coinbase Global, Inc., No. 24-cv-04850 (E.D. Pa. Oct. 21, 2026)).

Uncontradicted statements. First, statements about Coinbase’s compliance with anti-money-laundering and know-your-customer rules were not materially misleading. Statements that compliance was “robust” and “effective” and that the company has a “great anti-money laundering program” and was “really proud to be one of the most compliant crypto companies, frankly, in the world” were classic puffery. Other statements about AML/KYC compliance were statements of honest opinion that were grounded in fact. These statements were also protected by the PSLRA safe harbor.

The plaintiffs also failed to establish that the AML/KYC deficiencies meant that Coinbase’s statements about its number of verified users were false. This required an inferential leap that the court would not make. Rather than asking the court to infer fraud, the plaintiffs had to show how or why the user metrics were false.

Materialized risk. However, two statements about Coinbase’s cybersecurity threats were actionable misrepresentations. In its February 2025 Form 10-K and May 2025 Form 10-Q, Coinbase said that it had “administrative, technical, and physical security measures and controls in place and maintain[s] a robust information security program.” The filings also stated that service providers’ security measures “may be inadequate or breached as a result of third-party action” and “may be subject to … cybersecurity incidents.”

According to a news article cited by the plaintiffs, though, Coinbase knew as far back as January that customer data had leaked from a vendor. If the company knew about that breach and chose to speak about third-party cybersecurity, it had a duty to tell the whole truth: that data security was inadequate and that service providers were (not “may be”) subject to cybersecurity incidents.

No scienter. The two actionable misstatements nevertheless failed on scienter. First, the individual defendants’ stock sales were not particularly suspicious, especially over a class period of more than four years.

The plaintiffs also failed to show that Coinbase’s knowledge should be imputed to individual defendants. It remains unsettled whether the doctrine of corporate scienter is viable in the Third Circuit, but Handal v. Innovative Industrial Properties, Inc., 157 F.4th 279 (3d Cir. 2025), advised courts to ask whether the complaint adequately alleges that any individuals had scienter, whether imputation of scienter to the corporation is possible, and if not, whether scienter can be inferred based on a corporate scienter theory.

In this case, the plaintiffs’ scienter allegations depended on the defendants’ being “aware” of the data breach. But this did not establish with particularity that the individuals knew or had reason to suspect that Coinbase’s cybersecurity systems were so deficient that it was misleading to say the company had “security measures and controls in place.” The news article imputed knowledge to the company generally but did not establish that any particular defendant had such awareness. While it was plausible that individual defendants should have known about the incident, that suggested negligence rather than recklessness.

The court concluded that even if the doctrine of corporate scienter was viable in the Third Circuit, it would not apply here. The doctrine is reserved for the rare case involving “dramatically false” allegations; the two statements regarding Coinbase’s cybersecurity measures did not qualify.

The statements that the court had already determined were not misleading also were not made with scienter. Similarly to the cybersecurity statements, the plaintiffs merely pleaded generally that the defendants had knowledge of deficiencies in the AML/KYC compliance systems, without attributing this knowledge to any specific defendant. The PSLRA does not permit an inference of knowledge based on a defendant’s position within the company. At most, the allegations imputed negligence to the defendants.

The case is No. 24-cv-04850.

Judge: Slomsky, J.

Attorneys: Lawrence F. Stengel (Saxton Stump) for Erik Castle. Alexander C. Drylewski (Skadden, Arps, Slate, Meagher & Flom LLP) for Coinbase Global, Inc.

Companies: Coinbase Global, Inc.

MainStory: TopStory CyberPrivacyFeed DataBreach FedTracker GCNNews Securities FormsFilings FraudManipulation PublicCompanyReportingDisclosure PennsylvaniaNews DataPrivacy DataSecurity