A year after I investigated Coinbase’s security, liability and treatment of hacked customers, the company has become a powerful force in Washington. A new Wall Street Journal investigation examines that influence. My own experience raises a harder question: does scrutiny keep pace when corporate power grows this large?
By Sindhya Valloppillil
A year after I investigated Coinbase’s security, liability and treatment of hacked customers, the company has become an increasingly powerful force in Washington. A new Wall Street Journal investigation examines some of that influence. My own experience raises another question: what happens when corporate power begins to affect the environment in which a company is scrutinized?
Today, The Wall Street Journal published something I have rarely seen over the past year: a major mainstream story that seriously examines the power Coinbase and its CEO, Brian Armstrong, have accumulated.
The Journal’s account focuses on Washington, where Armstrong emerged as one of the crypto industry’s most consequential players during negotiations over the Clarity Act. It describes an extensive lobbying operation and reports that Armstrong’s influence became so significant that people involved in the negotiations believed he could effectively veto provisions he opposed. Coinbase says that Armstrong’s involvement improved the legislation and that the company made compromises to keep the broader coalition together.
I’ve seen surprisingly little sustained critical examination of Coinbase from mainstream business media relative to its size, controversies and growing influence. Today’s Journal article is the first I’ve encountered that seriously examines the power itself.
That matters because Coinbase is no longer simply a crypto exchange fighting for legitimacy. It is a publicly traded financial company, a major custodian of digital assets, a competitor to traditional banks and an increasingly powerful force in Washington.
And that raises a question larger than crypto: What happens when a company becomes powerful enough not merely to operate within a system, but to influence the rules, institutions and conversations surrounding it?
What Happened When I Investigated Coinbase
Last September, I published Coinbase’s Fortress Is Crypto’s Achilles’ Heel: User and Investor Lawsuits Reveal Security Concerns in Forbes, examining Coinbase’s May 2025 breach, hacked-account complaints, customer liability, litigation, customer-service failures and provisions in its User Agreement.
The article trended for several days before it was subsequently redacted. Coinbase’s crisis-communications team disputed portions of my reporting. I stand by the central questions the investigation raised, many of which remain unanswered.
A year later, however, I’m interested in something larger: the institutional power Coinbase has accumulated around those unanswered questions.
The Questions That Never Went Away
Coinbase had disclosed a serious data breach in May 2025 involving overseas customer-support personnel who had been bribed by attackers. The company said the attackers obtained personal information belonging to customers but did not gain access to passwords, private keys or customer funds. Coinbase said it would reimburse customers who were tricked into sending funds to the attackers as a result of that particular incident.
That was important, but it wasn’t the only thing I was trying to understand. I wanted to know what happens to an individual customer after they tell Coinbase that an account has been compromised.
- Does Coinbase increase monitoring or security protections?
- What happens when a customer reports one compromise and is subsequently compromised again?
- If the account is eventually emptied, does Coinbase’s assessment of its responsibility change?
- What does the customer-service escalation process actually look like? Who owns the case? When does it end?
- And what recourse exists for customers whose losses fall outside an incident for which Coinbase has independently decided to reimburse victims?
Coinbase’s responses to my reporting focused on the May 2025 incident. The company told me affected customers were reimbursed and described additional safeguards, including identity checks, security prompts and monitoring of high-risk transactions.
Those are meaningful responses but don’t resolve the larger question: What does “secure and trusted” mean after something has already gone wrong?
Coinbase Has Gone Mainstream. Its Support System Has Not.
For a consumer financial platform, security is not merely about preventing an attack – it depends on what happens afterward.
Can the customer reach someone? Does the company recognize that an account has already been targeted and adjust its risk profile? Are meaningful escalation and recovery mechanisms available when something goes wrong? Who bears the loss? How quickly is the customer made whole, if at all? These issues become especially important as Coinbase moves beyond crypto-native traders into the mainstream.
My mother, a retired pediatrician, has a Coinbase account. She is precisely the kind of mainstream customer the company worked to attract. So is tech executive David Scoville, who wrote a viral Substack essay about losing $130,000 in a sophisticated scam involving his Coinbase account.
But technical sophistication offers no guarantee either. I’ve spoken with tech VCs whose personal Coinbase accounts were hacked, resulting in millions of dollars in losses, including one who was an early investor in the company. And even prominence doesn’t necessarily buy a smoother experience: Kevin Durant spent years unable to access an old Coinbase account before eventually regaining access.
These are very different situations. Durant’s was an account-access problem, not a hack, and Scoville’s involved a broader scam. But together they expose the same weakness in the mainstreaming of crypto: customers should not need to be cybersecurity experts, crypto insiders or celebrities with extraordinary resources to navigate a financial platform when something goes wrong.
If Coinbase wants mainstream trust, its security, escalation and recovery systems need to be strong enough before, during and after an incident.
The Lawsuits Didn’t Go Away
Last month, a federal judge allowed a long-running securities class action against Coinbase and its senior executives to move forward. The plaintiffs allege misleading statements concerning regulatory and bankruptcy-related risks.
Separately, a Coinbase shareholder sued Armstrong and other executives in March alleging misleading disclosures involving custody, securities listings and anti-money-laundering controls.
This is no longer just a customer-grievance story. Coinbase’s own shareholders are asking courts to examine questions involving the company’s governance, disclosures and internal controls.
The allegations remain contested. But the accountability questions now extend beyond customers to Coinbase’s own investors.
Coinbase Wants to Become Part of the Financial System
The stakes have changed because Coinbase’s ambitions have changed. Armstrong hasn’t been shy about wanting to reinvent traditional financial services. Coinbase increasingly competes not just with other crypto exchanges but with parts of the banking and payments ecosystem.
The comparison with banks requires precision. FDIC insurance covers bank failures, not hacked checking accounts, and Regulation E does not guarantee reimbursement for every fraud scenario. Traditional banks nonetheless operate with a far more developed consumer protection framework than crypto exchanges do.
As Coinbase increasingly competes with regulated financial institutions for customers’ money, what protections should its customers reasonably expect when something goes wrong?
Coinbase Has Become a Washington Power Broker
Today’s Wall Street Journal reporting illustrates just how dramatically Coinbase’s position has evolved. According to the Journal, Armstrong became a central participant in negotiations over the Clarity Act, legislation intended to establish a more comprehensive federal framework for digital assets. One major fault line was stablecoin rewards, where Coinbase pushed back against restrictions that banks argued could siphon deposits away from traditional financial institutions.
The issue is how much influence one company should wield over the rules of an industry that it stands to profit from. Coinbase’s political influence extends beyond lobbying. The Financial Times reports that Coinbase is also a major backer of Fairshake, the crypto super PAC that entered the 2026 election cycle with a war chest exceeding $100 million.
Coinbase isn’t merely asking Washington for permission to operate anymore. It is participating in negotiations over the rules governing how crypto will compete with the banking system itself. And once a company reaches that level of institutional importance, scrutiny of its treatment of customers, governance and business practices becomes more important, not less.
The Power to Shape Washington. What About the Power to Shape Coverage?
Today’s Journal story documents Coinbase’s influence in Washington. My experience made me wonder about a different institution: the press.
Does Coinbase’s institutional power make news organizations more cautious about scrutinizing it? I have no evidence that Coinbase dictates editorial decisions. Advertising, sponsorship, executive access or aggressive public relations do not prove editorial influence, but they are part of the institutional environment in which coverage gets produced.
Access, advertising and relationships all create incentives. And a sophisticated communications operation can increase the time, friction and institutional cost of adversarial reporting.
I don’t know why sustained critical coverage of Coinbase has been relatively scarce compared with its scale and controversies. But after watching what happened to my own article, I think the absence itself deserves scrutiny.
When a company becomes sufficiently important to investors, advertisers, policymakers and an entire industry, does scrutinizing it become institutionally harder?
Who Holds the Gatekeeper Accountable?
A year ago, I thought Coinbase’s biggest vulnerability was security. I was looking too narrowly. The bigger story is power.
Coinbase has evolved from a venture-backed startup into a public company capable of challenging banks, shaping legislation and helping define the architecture of American finance. None of that is inherently improper, but power raises the standard for scrutiny. Does scrutiny scale with influence? It should.
Coinbase spent years asking consumers, investors and policymakers to take crypto seriously. They did. Now the question is whether the institutions surrounding one of America’s most powerful financial technology companies are willing to scrutinize it with equal seriousness.
Who holds Coinbase accountable when Coinbase becomes powerful enough to help write the rules?
Disclosure: AI tools assisted with research, structure and editing. I verified the claims and take responsibility for the argument. That is the point.
Tw previous articles: The AI Detectors Said WIRED’s Fake Journalist Was Human explores how WIRED got punked by a fake freelancer. Then AI detectors said the fabricated story was human-written. The problem wasn’t the journalism.
Substack Could Own Independent Media. Instead, It’s Chasing Social Media. Substack doesn’t have an AI slop problem. It has a slop problem. More features won’t solve it. It needs a strategy for discovery, quality, trust and the marketplace it has already built.
Enjoyed this? Please share it!
Sindhya Valloppillil is a journalist, tech editor, and strategist who investigates the incentives, contradictions, and power structures reshaping industries — covering AI, venture capital, health tech, longevity, beauty, and the consumer economy. Her reporting has appeared in Forbes, TechCrunch, Fast Company, and Business Insider, frequently trends on Google News, and is regularly republished by affiliates and industry newsletters. A former marketing professor and executive at L’Oréal, L Brands, and Johnson & Johnson, she is also the founder of Skin Dossier and advises founders, investors, and leadership teams on strategy and market positioning. She is currently writing her first book.
The Signal covers where leverage is moving—and who’s capturing it.
This Substack is reader-supported. To receive new posts and support my work, consider becoming a free subscriber.
Thanks for reading! Subscribe for free to receive new posts and support my work.