Highlights:

• The Federal Trade Commission (“FTC”) voted 2-0 in favor of settling allegations that the Tech Company failed to implement adequate data security measures.
• The alleged security breach resulted in hackers stealing approximately $186 million from consumers.
• The Company agreed to return recovered funds to consumers, to the extent they were not previously returned.

Case Summary:

In December 2025, the Federal Trade Commission announced a settlement with a Tech Company that provides a digital asset transfer platform. The settlement resolves claims that the Company failed to take reasonable security measures while publicly claiming to prioritize security. The FTC states these failures contributed to a 2022 hack draining about $186 million of consumer funds. The FTC voted 2-0 to accept the complaint and consent order for public comment.

The complaint alleges the Company overstated its commitment to data security and lacked basic software and security controls. In particular, the FTC alleges that the Company implemented new code in mid-2022 without adequate testing, which created a vulnerability exploited by hackers. The Company also failed to implement common safeguards like secure coding, incident response, transaction monitoring, and suspicious activity measures, and it lacked staff and processes to detect risks promptly. The FTC further alleges that the Company resisted reimbursing consumers in connection with a prior incident.

The order requires the Company to stop misrepresenting its security practices and enforce a comprehensive security program, evaluated every two years for ten years. It also mandates returning about $37.5 million of recovered assets to affected consumers.

RESOURCES:

You can review all of the relevant administrative filings and press releases at the FTC’s Enforcement Page.

• Press Release