A Tale of Two Coinbases

For Coinbase it was the best of weeks and the worst of weeks- all wrapped into one.

Let’s lead with the positive- last Monday S&P Global announced that it was adding Coinbase to its benchmark S&P 500 stock index. This marks a watershed moment for the crypto sector, a major psychological milestone signifying the mainstreaming of an industry that not long ago seemed on the ropes as a result of multiple scandals and depressed asset prices.

Adding to the symbolic changing of the guard was the company Coinbase is replacing in the index- Discover. A slot for a financial services firm opened up as a result of Capital One’s long-delayed acquisition of Discover. A “new economy” disruptor is therefore taking the place of a legacy card issuer/network as a widely accepted measure of US equity markets (see footnote for additional context).

It’s a nice validation for the crypto sector as a whole, but an especially lucrative one for Coinbase itself- whose stock popped 24% the day following the news. Some of this rise can likely be attributed to the added visibility and implied legitimization, but most is driven by a fundamental shift in demand for the stock. Legions of index funds suddenly found themselves required to add COIN to their portfolios to map to the S&P’s updated composition.

Then came the bad news. Just two days later, Coinbase disclosed a data leak that exposed sensitive information including customers’ names, physical and email addresses, phone numbers, driver’s licenses and passports and the last four digits of Social Security numbers. According to the company fewer than 1 percent of “monthly transacting users” were impacted (a curious distinction IMO- what about those that don’t transact regularly?) and it refused to pay a $20 million extortion demand.

I’m intentionally using the word “leak” rather than “breach” because according to Coinbase, hackers did not gain direct access to its system. Instead, “overseas” customer service agents (either employees or contractors) were bribed to extract the data. The firm’s required SEC breach disclosure notification estimates the high end of the range for remediation cost at $400 million. Coinbase stock retreated 7% on the news.

Although customer funds were reportedly not accessed (although a rash of spearfishing attempts quickly followed), I find it interesting that we’ve reached a juncture where the bribing of employees (plural!) to reveal the sensitive details of tens of thousands of customers is greeted with something approaching a sigh of relief. By the end of Friday’s trading day Coinbase had recouped its losses and notched a new high.

I’m guessing that with the benefit of hindsight- and an airtight pledge of secrecy- Coinbase would have signed up for this warts-and-all package of news, especially given how forgiving the market has been thus far regarding the leak. I remain somewhat guarded, however, as data security issues like these rarely resolve so tidily. The inevitable rash of class action lawsuits will attest to that.  

***********     

(NOTE: A couple of clarifying points- this does not mean Coinbase is now one of the 500 largest US public companies. The S&P 500 is an index that aims to reflect the proportions of the broader market. Companies must meet a set of profitability/liquidity/stability criteria to be considered for inclusion– which is an impressive achievement in itself for Coinbase- but more than 500 companies qualify.

Coinbase is now one of roughly 70 components representing the financial services sector. PayPal is another component that many would consider a disruptor. Also, Discover’s business remains part of the index since Capital One is also a component. )