Coinbase

New or substantially reworded (7)

• For example, as previously disclosed on a Current Report on Form 8-K filed with the SEC on May 15, 2025, a threat actor improperly obtained information about certain customer accounts and internal documentation, and used that information for social-engineering attempts. No passwords or private keys were compromised as a result of this incident. We continue to face risks related to this incident, including harm to our reputation, governmental investigations and regulatory scrutiny, and ongoing litigation.

• asset transactions, as has occurred in certain jurisdictions in the past. Read more

  For example, in the past few years, regulatory developments in the area of anti-money laundering, recordkeeping and prudential regulatory compliance include the Travel Rule requiring transmission of information with crypto transfers. This and similar regulations increase our compliance costs, may require operational changes, and could subject us to sanctions for technical violations.

• from Coinbase’s own and other client funds, and uses tightly controlled settlement flows to preserve access to global liquidity and fast execution.

• For example, as a result of our acquisition of Deribit in August 2025, we now provide additional cryptocurrency products and services internationally, including options and perpetual swaps. Read more

  If we are unable to successfully integrate Deribit or comply with evolving U.S. and international crypto and derivatives regulations applicable to our expanded operations and products, we could be required to modify or discontinue certain offerings, face limitations on our ability to onboard or serve customers in key markets, incur substantial compliance and remediation costs, or be subject to penalties and other enforcement actions, any of which could adversely affect our business, operating results, and financial condition.

• The increasing sophistication of AI poses a greater risk of identity fraud, as malicious actors may exploit various AI technologies to create increasingly convincing false identities, transaction records, or attempt to manipulate our verification processes. This necessitates ongoing enhancements to our verification systems and security protocols to prevent unauthorized access and protect sensitive information. Failure to manage these risks or to implement effective countermeasures could lead to unauthorized transactions, financial losses, reputational damage and increased regulatory scrutiny.

• Our bylaws contain an ownership threshold that must be met for a shareholder or shareholders to bring derivative claims against our officers or directors, which could limit a shareholder’s ability to bring such claims. Read more

  In addition, Texas law does not recognize demand futility and as such may require additional procedural steps for a shareholder to bring a derivative claim.

• Our bylaws provide that no shareholder or group of shareholders may in institute or maintain a derivative proceeding brought on our behalf against any of our directors or officers, unless the shareholder or group of shareholders, at the time the derivative proceeding is instituted, beneficially owns a number of shares of common stock sufficient to meet an ownership threshold of at least 3% of our total outstanding shares. In addition, Texas law generally does not recognize demand futility, which means that a shareholder bringing such a claim must provide our board of directors an opportunity to determine whether the claim is in our best interests before the shareholder may proceed with a lawsuit. Our board of directors will generally have 90 days in which to make this determination.

No longer in the text (4)

• For example, in 2021, third parties independently obtained login credentials and personal information for at least 6,000 customers and used those credentials to exploit a vulnerability that previously existed in the account recovery process. Read more

  We reimbursed impacted customers approximately $25.1 million.

• Additionally, various governmental and regulatory bodies, including legislative and executive bodies, in the United States and in other countries may adopt new laws and regulations, the direction and timing of which may be influenced by changes in the governing administrations and major events in the cryptoeconomy. For example, following the failure of several prominent crypto trading venues and lending platforms, such as FTX, Celsius Networks, Voyager and Three Arrows Capital in 2022 (the “2022 Events”), the U.S. Congress expressed the need for both greater federal oversight of the cryptoeconomy and comprehensive cryptocurrency legislation.

• We have been, currently are, and may from time to time become subject to claims, arbitrations, individual and class action lawsuits with respect to a variety of matters, including employment, consumer protection, advertising, and securities. Read more

  In addition, we have been, currently are, and may from time to time become subject to, government and regulatory investigations, inquiries, actions or requests, other proceedings and enforcement actions alleging violations of laws, rules, and regulations, both foreign and domestic. For example, in January 2023, we settled a NYDFS compliance investigation for a monetary penalty of $50.0 million and a separate commitment to make $50.0 million in compliance program investments by the end of 2024. In June 2023, the SEC filed the June 2023 SEC Complaint, in connection with which the SEC is seeking, among other relie f, injunctive relief, disgorgement,…

• A significant amount of the Trading Volume on our platform is derived from a relatively small number of users, and the loss of these users, or a reduction in their Trading Volume, could have an adverse effect on our business, operating results, and financial condition.