Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

376 paragraphs · Finance Services show all sectors

In response to these events, the crypto asset markets, including the market for Bitcoin specifically, have experienced extreme price volatility and several other entities in the crypto asset industry have been, and may continue to be, negatively affected, further undermining confidence in the crypto asset market and in Bitcoin. These events have also negatively impacted the liquidity of the crypto asset market as certain entities affiliated with FTX engaged in significant trading activity. If the liquidity of the crypto asset market continues to be negatively impacted by these events, crypto asset prices, including the price of Bitcoin, may continue to experience significant volatility and confidence in the crypto asset markets may be further undermined. A perceived lack of stability in the crypto asset exchange market and the closure or temporary shutdown of crypto asset exchanges due to business failure, hackers or malware, government-mandated regulation or fraud, may reduce confidence at least in part in crypto asset networks and result in greater volatility in Bitcoin’s value. Because the value of Bitcoin is derived from the continued willingness of market participants to exchange government-issued currency that is designated as legal tender in its country of issuance through government decree, regulation or law for Bitcoin, should the marketplace for Bitcoin be jeopardized or disappear entirely, permanent and total loss of the value of Bitcoin may result. Such a decrease in Bitcoin price may have a material and adverse effect on Gryphon’s results of operations and financial condition as the results of Gryphon’s operations are significantly tied to the price of Bitcoin.

Read in the 10-K filed Mar 31, 2025 ↗

These events are continuing to develop and it is not possible to predict, at this time, every risk that they may pose to Gryphon, Gryphon’s service providers, or the digital asset industry as a whole. A perceived lack of stability in the digital asset exchange market and the closure or temporary shutdown of digital asset exchanges due to business failure, hackers or malware, government-mandated regulation, or fraud, may reduce confidence in digital asset networks and result in greater volatility in cryptocurrency values. These potential consequences of a digital asset exchange’s failure could adversely affect an investment in Gryphon.

Read in the 10-K filed Mar 31, 2025 ↗

There is a risk that some or all of Gryphon’s bitcoin could be lost or stolen. Cryptocurrencies are stored in cryptocurrency sites commonly referred to as “wallets” by holders of cryptocurrencies, which may be accessed to exchange a holder’s cryptocurrency assets. Access to Gryphon’s bitcoin assets could also be restricted by cybercrime (such as a denial of service attack) against a service at which Gryphon maintains a hosted hot wallet. A hot wallet refers to any cryptocurrency wallet that is connected to the Internet. Generally, hot wallets are easier to set up and access than wallets in cold storage, but they are also more susceptible to hackers and other technical vulnerabilities. Cold storage refers to any cryptocurrency wallet that is not connected to the Internet. Gryphon holds its bitcoin solely in cold custodial wallets with keys managed by BitGo Trust. Cold storage is generally more secure than hot storage, but is not ideal for quick or regular transactions, and Gryphon may experience lag time in its ability to respond to market fluctuations in the price of Gryphon’s bitcoin assets.

Read in the 10-K filed Mar 31, 2025 ↗

Hackers or malicious actors may launch attacks to steal, compromise or secure bitcoin, such as by attacking the Bitcoin network source code, exchange miners, third-party platforms, cold and hot storage locations or software, through phishing schemes or by other means. Several errors and defects in such codes have been found previously, including those that disabled some functionality for users and exposed users’ information. Exploitations of flaws in the source code that allow malicious actors to take or create money have previously occurred. Despite Gryphon’s efforts and processes to prevent breaches, Gryphon’s devices, as well as Gryphon’s miners, computer systems and those of third parties that Gryphon uses in its operations, are vulnerable to cybersecurity risks, including cyberattacks such as viruses and worms, phishing attacks, denial-of-service attacks, physical or electronic break-ins, employee theft or misuse, and similar disruptions from unauthorized tampering with Gryphon’s miners and computer systems or those of third parties that Gryphon uses in its operations. Any of these events may adversely affect Gryphon’s operations and, consequently, Gryphon’s investments and profitability. The loss or destruction of a private key required to access Gryphon’s digital wallets may be irreversible and Gryphon may be denied access for all time to its bitcoin holdings or the holdings of others held in those compromised wallets. Gryphon’s loss of access to its private keys or a data loss relating to Gryphon’s digital wallets could adversely affect Gryphon’s investments and assets.

Read in the 10-K filed Mar 31, 2025 ↗

Cryptocurrencies are controllable only by the possessor of both the unique public and private keys relating to the local or online digital wallet in which they are held, which wallet’s public key or address is reflected in the network’s public blockchain. Gryphon will publish the public key relating to digital wallets in use when Gryphon verifies the receipt of transfers and disseminates such information into the network, but Gryphon will need to safeguard the private keys relating to such digital wallets. We safeguard and keep private the private keys relating to our digital assets by relying on BitGo Trust’s (as defined herein) 100% cold storage custody solution held in a purpose-built physically-secure environment based on established, industry best practices to safeguard our digital assets from theft, loss, destruction or other issues relating to hackers and technological attack. Gryphon’s CEO holds Gryphon side private keys that are protected with two-factor authentication. Gryphon confirms transactional validity and data for revenue recognition through a daily review and reconciliation of BitGo reports. Custodial side keys are held by BitGo Trust who verifies requests with two factor authentication and video reviews. To the extent such private keys are lost, destroyed or otherwise compromised, Gryphon will be unable to access its bitcoin rewards and such private keys may not be capable of being restored by any network. Any loss of private keys relating to digital wallets used to store Gryphon’s bitcoin could have a material adverse effect on Gryphon’s ability to continue as a going concern or to pursue its new strategy at all, which could have a material adverse effect on Gryphon’s business, prospects or operations and potentially the value of any bitcoin that Gryphon mines or otherwise acquires or holds for its own account.

Read in the 10-K filed Mar 31, 2025 ↗

The history of digital asset exchanges has shown that exchanges and large holders of digital assets must adapt to technological change in order to secure and safeguard their digital assets. We rely on Bitgo Trust’s 100% cold storage custody solution held in a purpose-built physically-secure environment based on established, industry best practices to safeguard our digital assets from theft, loss, destruction or other issues relating to hackers and technological attack. We believe that it may become a more appealing target of security threats as the size of our bitcoin holdings grow. To the extent that either BitGo Trust or we are unable to identify and mitigate or stop new security threats, our digital assets may be subject to theft, loss, destruction or other attack, which could adversely affect an investment in us. To the extent that BitGo Trust is no longer, due to the current banking crisis, able to safeguard our assets, we would be at risk of loss if safeguarding protocols fail.

Read in the 10-K filed Mar 31, 2025 ↗

Gryphon receives bitcoin rewards from its mining activity through a third-party mining pool operator. Mining pools allow miners to combine their processing power, which increases miners’ chances of solving blocks and receiving bitcoin rewards from the network. The rewards are distributed by the pool operator, proportionally to Gryphon’s contribution to the pool’s overall mining power, after deducting the applicable pool fee, if any, used to solve a particular block on the Bitcoin blockchain. Should the pool operator’s system suffer downtime due to a cyber-attack, software malfunction or other issue, Gryphon’s ability to mine and receive revenue will be negatively impacted.

Read in the 10-K filed Mar 31, 2025 ↗

Information security risks for technology companies, such as the Company, have significantly increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error or accidental technological failure. These threats include cyberattacks, such as computer viruses, malicious code, phishing attacks or information security breaches.

Read in the 10-K filed Mar 31, 2025 ↗

If a cyberattack or other information security breach occurs, it could lead to security breaches of the networks, systems or devices that our customers use to access our products and services which could result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information (including account data information) or data security compromises. Such events could also cause service interruptions, malfunctions or other failures in the physical infrastructure or operations systems that will support our businesses and customers, as well as the operations of our customers or other third parties. Any actual attacks could lead to damage to our reputation with our customers and other parties and the market, additional costs to the Company (such as repairing systems, adding new personnel or protection technologies or compliance costs), regulatory penalties, financial losses to both us and our customers and collaborators and the loss of customers and business opportunities. If such attacks are not detected immediately, their effect could be compounded.

Read in the 10-K filed Mar 31, 2025 ↗

New and evolving regulations and compliance standards for cybersecurity, data protection, privacy, and internal IT controls are often created in response to the tide of cyberattacks and will increasingly impact organizations like our company. Existing regulatory standards require that organizations implement internal controls for user access to applications and data. In addition, data breaches are driving a new wave of regulation, such as the GDPR, with stricter enforcement and higher penalties. Regulatory and policy-driven obligations require expensive and time-consuming compliance measures. The fear of non-compliance, failed audits, and material findings has pushed organizations to spend more to ensure they are in compliance, often resulting in costly, one-off implementations to mitigate potential fines or reputational damage. The high costs associated with failing to meet regulatory requirements, combined with the risk of fallout from security breaches, may force us to spend additional time and money ensuring we will meet future regulatory requirements.

Read in the 10-K filed Mar 31, 2025 ↗

Moreover, certain laws and regulations of U.S. states and the EU impose similar or greater data protection requirements and may also subject us to scrutiny or attention from regulatory authorities. For example, the EU and California have passed comprehensive data privacy laws, the EU GDPR and the CCPA and regulations promulgated under the CCPA, respectively, which impose data protection obligations on enterprises, including limitations on data uses and constraints on certain uses of sensitive data. Of particular importance, the CCPA, which became effective on January 1, 2020, limits how we may collect and use personal information, including by requiring companies that process information relating to California residents to make disclosures to consumers about their data collection, use and sharing practices, provide consumers with rights to know and delete personal information and allow consumers to opt out of certain data sharing with third parties. The CCPA also creates an expanded definition of personal information, imposes special rules on the collection of consumer data from minors, and provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase the likelihood and cost of data breach litigation. The potential effects of this legislation are far-reaching and may require us to modify our data processing practices and policies and incur substantial costs and expenses in compliance and potential ligation efforts. Effective January 1, 2023, we also became subject to the CPRA in California, which expands upon the consumer data use restrictions, penalties and enforcement provisions under the CCPA.

Read in the 10-K filed Mar 31, 2025 ↗

social engineering schemes, the introduction of computer viruses, ransomware or other malware, and the physical destruction of all or portions of our information technology and infrastructure could compromise the confidentiality, availability and integrity of the information (including consumers’ personal information) in and being processed by our systems. Although we have developed systems and processes designed to protect information we manage, prevent data loss and other security breaches and to permit us to effectively respond to known and potential risks, and we expect to continue to expend significant resources to bolster these systems and processes, there can be no assurance that our security measures will provide absolute security or have prevented or will prevent breaches, security incidents or attacks, in particular, as the frequency and sophistication of cyberattacks increases.

Read in the 10-K filed Mar 20, 2025 ↗

Cybersecurity, data privacy and intellectual property risks: Cybersecurity incidents may compromise systems; intellectual property disputes or alleged infringements could disrupt our business; accounting for digital assets and fair value measurements; potential impairment charges; auditor transitions; internal control considerations.

Read in the 10-K filed Nov 21, 2025 ↗

Our rewards are typically earned via pooled mining. We rely on pool operators to honestly and accurately account for our pro rata share of rewards, maintain operational security, and remit proceeds. Pools may lack insurance for theft or loss, and rewards may be held for varying durations. Any failure, insolvency, cyber event, mispricing, or suspension by a pool operator could delay or reduce our receipts or result in losses. A change in pool fee structures or terms could adversely affect yields.

Read in the 10-K filed Nov 21, 2025 ↗

Cybersecurity incidents, including data breaches and ransomware, may compromise systems, disrupt operations, and cause financial loss.

Read in the 10-K filed Nov 21, 2025 ↗

Our customers’ businesses are subject to extensive laws, rules, regulations, policies and legal and regulatory guidance, including those governing securities, commodities, exchange and transfer, data governance, data protection, cybersecurity and tax. Many of these legal and regulatory regimes were adopted prior to the advent of the Internet, mobile technologies, AI and related technologies, cloud services and data center operations. As a result, they do not contemplate or address unique issues associated with AI, are subject to significant uncertainty, and vary widely across U.S., Iceland and Canada. These legal and regulatory regimes, including the laws, rules and regulations thereunder, evolve frequently and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another.

Read in the 10-K filed Mar 14, 2025 ↗

We may also experience disruptions due to mechanical failure, human error, physical or electronic security breaches, war, terrorism, fire, earthquake, pandemics, hurricane, flood and other natural disasters, sabotage and vandalism. Our systems may be susceptible to damage, interference, or interruption from modifications or upgrades, power loss, telecommunications failures, computer viruses, ransomware attacks, computer denial of service attacks, phishing schemes, or other attempts to harm or access our systems. Such disruptions could materially and adversely affect our business and our financial condition, operating results, cash flows, and prospects.

Read in the 10-K filed Mar 14, 2025 ↗

Other than Compute North, we have not been directly impacted by any of the recent bankruptcies in the digital asset space, as we have no contractual privity or relationship to the relevant parties. The Company relocated its miners out of Compute North’s facilities to those hosted by Blockfusion and Coinmint in New York State. However, termination of the Master Agreement with Compute North had an adverse effect on the Company’s business and financial condition. Such recent events have contributed, at least in part, to our and our peers stock price as well as the price of bitcoin. If the liquidity of the digital assets markets continues to be negatively impacted, digital asset prices (including the price of bitcoin) may continue to experience significant volatility and confidence in the digital asset markets may be further undermined. A perceived lack of stability in the digital asset exchange market and the closure or temporary shutdown of digital asset exchanges due to business failure, hackers or malware, government-mandated regulation, or fraud, may reduce confidence in digital asset networks and result in greater volatility in digital asset values. Any of these events may adversely affect our operations and results of operations and, consequently, an investment in us.

Read in the 10-K filed Mar 14, 2025 ↗

In order to minimize risk, we have established processes to manage wallets that are associated with our digital assets holdings. There can be no assurances that any processes we have adopted or will adopt in the future are or will be secure or effective, and we would suffer significant and immediate adverse effects if we suffered a loss of our digital assets due to an adverse software or cybersecurity event. We utilize several layers of threat reduction techniques, including: (i) the use of hardware wallets to store sensitive private key information; (ii) performance of transactions offline; and (iii) offline generation storage and use of private keys.

Read in the 10-K filed Mar 14, 2025 ↗

There is a risk that some or all of our digital assets, including bitcoin, ETH, liquid staking tokens and/or USD Coin could be lost, stolen or destroyed. Digital assets are stored in platforms commonly referred to as “wallets” by holders of bitcoins which may be accessed to exchange a holder’s bitcoin assets. Access to our digital assets could also be restricted by cybercrime (such as a denial-of-service attack) against a service at which we maintain a hosted hot wallet. We believe that our digital assets will be an appealing target to hackers or malware distributors seeking to destroy, damage or steal our digital assets. See Risk Factor “Cyberattacks and security breaches of our system, or those impacting our third parties, could adversely impact our brand and reputation and our business, operating results, and financial condition.” A hot wallet refers to any bitcoin wallet that is connected to the Internet. Generally, hot wallets are easier to set up and access than wallets in cold storage, but they are also more susceptible to hackers and other technical vulnerabilities. Cold storage refers to any bitcoin wallet that is not connected to the Internet. Cold storage is generally more secure from external attack than hot storage but is not ideal for quick or regular transactions and we may experience lag time in our ability to respond to market fluctuations in the price of our bitcoin assets. Moreover, cold storage may increase the risk of internal theft or malfeasance. We hold our digital assets in hot and cold wallets through third party custodians to reduce the risk of external malfeasance, but the risk of loss of our bitcoin assets cannot be wholly eliminated. If any of our bitcoin were lost or stolen, it is unlikely that we would ever be able to recover such bitcoin.

Read in the 10-K filed Mar 14, 2025 ↗

Hackers or malicious actors may launch attacks to steal, compromise or secure digital assets, such as by attacking the digital asset network source code, exchange miners, third-party platforms, cold and hot storage locations or software, our general computer systems or networks, or by other means. We cannot guarantee that we will prevent loss, damage or theft, whether caused intentionally, accidentally or by act of God. Access to our digital assets could also be restricted by natural events (such as an earthquake or flood) or human actions (such as a terrorist attack). We may be in control and possession of one of the more substantial holdings of digital assets. As we increase in size, we may become a more appealing target of hackers, malware, cyber-attacks or other security threats. Any of these events may adversely affect our operations and, consequently, our investments and profitability. The loss or destruction of a private key required to access our digital wallets may be irreversible and we may be denied access for all time to our digital asset holdings held in those compromised wallets. Our loss of access to our private keys or our experience of a data loss relating to our digital wallets could adversely affect our investments and assets.

Read in the 10-K filed Mar 14, 2025 ↗

We use third–party mining pools to receive our mining rewards from the network. Mining pools allow miners to combine their processing power, increasing their chances of solving a block and getting paid by the network. The rewards are distributed by the pool operator, proportionally to our contribution to the pool’s overall mining power, used to generate each block. Should the pool operator’s system suffer downtime due to a cyberattack, software malfunction or other similar issues, it will negatively impact our ability to mine and receive revenue. Furthermore, we are dependent on the accuracy of the mining pool operator’s record keeping to accurately record the total processing power provided to the pool for a given bitcoin mining application in order to assess the proportion of that total processing power we provided. While we have internal methods of tracking both our power provided and the total used by the pool, the mining pool operator uses its own record-keeping to determine our proportion of a given reward. We have little means of recourse against the mining pool operator if we determine the proportion of the reward paid out to us by the mining pool operator is incorrect, other than leaving the pool. If we are unable to consistently obtain accurate proportionate rewards from our mining pool operators, we may experience reduced reward for our efforts, which would have an adverse effect on our business and operations.

Read in the 10-K filed Mar 14, 2025 ↗

Currently, we do not have any insurance to cover our digital assets or mining equipment. The market for such insurance is in the early stages and we intend to purchase such insurance in the future. One of our digital asset custodians, Cactus Custody, is self-insured for $4 million plus annual additions. Any uninsured losses may have an adverse effect on our results of operations and/or financial condition. Fireblocks offers Fireblocks Institutional Digital Asset Program which is insured by leading insurance companies which are A.M. Bests rated “A” (excellent). There is an aggregate of $30,000,000 digital asset crime insurance for theft of digital assets, external breach of Fireblocks’ software or any malicious or intentional misbehavior or fraud by employees. Fireblocks has $12,500,000 of aggregate insurance for errors and omissions; professional liability insurance and cyber/privacy liability insurance.

Read in the 10-K filed Mar 14, 2025 ↗

The Cybersecurity Review Measures (2021) (the “Measures”) were officially released to the public on December 28, 2021 and became effective on February 15, 2022. According to the Measures, to go public abroad, an online platform operator that possesses the personal information of more than 1 million users must seek cybersecurity review from the Office of Cybersecurity Review.

Read in the 10-K filed Mar 14, 2025 ↗

Currently, we have not been involved in any investigations on cybersecurity review initiated by the CAC or related governmental regulatory authorities, and we have not received any inquiry, notice, warning, or sanction in such respect.

Read in the 10-K filed Mar 14, 2025 ↗

We believe we currently are not required to obtain clearance from the CAC regarding our listing in the United States under the recently-enacted or proposed regulations or rules because we have never set an online platform for any user and we have not acted as an online platform operator. However, since these cybersecurity rules were recently enacted and uncertainties exist as to the interpretation or implementation of the Measures, if the Measures require us to obtain clearance or permissions from the CAC, we would file an application with CAC and seek to obtain the clearance or permissions from the CAC as required, however there can be no assurance we will obtain clearance or permission which could adversely affect our business. Compliance with the Measures, as well as additional laws, regulations and guidelines that the Chinese government promulgates in the future, may entail significant expenses and could materially affect our business.

Read in the 10-K filed Mar 14, 2025 ↗

The national laws of the PRC, including, but not limited to the Cybersecurity Review Measures that became effective on February 15, 2022, do not currently apply to our Hong Kong subsidiaries, except for those listed in the Basic Law of Hong Kong. However, due to changes in laws, regulations or policies, including how those laws, regulations or policies would be interpreted or implemented, and the national laws applicable in Hong Kong, the Basic Law might be revised in the future and our Hong Kong subsidiaries may be subject to certain PRC laws.

Read in the 10-K filed Mar 14, 2025 ↗

Risk Assessment: We conduct risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments are designed to identify reasonably foreseeable internal and external material cybersecurity risks to our critical systems, information, products, services, and our broader Company-wide IT environment, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Risk assessments take into account information from internal stakeholders, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants as needed. The results of our assessments are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that is then periodically reported to our Board and Audit Committee.

Read in the 10-K filed Mar 20, 2025 ↗

Incident Response and Recovery Planning: We have established a comprehensive incident response and recovery plan that guides our response in the event of a cybersecurity incident.

Read in the 10-K filed Mar 20, 2025 ↗

Vendor Risk Management: We have implemented a robust vendor risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers in response to questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and investigate security incidents that have impacted our third-party providers, as appropriate. We also obtain and review Systems and Organization Control (“SOC”) reports from several of our key service providers.

Read in the 10-K filed Mar 20, 2025 ↗

Education and Awareness: Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees and third-party contractors of the importance of handling and protecting data, including through privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. All employees and third-party contractors are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident.

Read in the 10-K filed Mar 20, 2025 ↗

Our Audit Committee considers cybersecurity risks and other information technology risks as part of its risk oversight function and evaluates our risk assessment and management policies, including periodic discussions with our senior officers. In addition, management updates the Board of Directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Our Audit Committee also meets at least quarterly with our independent registered accounting firm and communicates with them regarding any cybersecurity-related risks.

Read in the 10-K filed Mar 20, 2025 ↗

As a publicly traded company, we and third parties that we rely upon face numerous and evolving cybersecurity threats and experience cyber-attacks, such as phishing and other attempts to gain unauthorized access to our systems on a regular basis, and we anticipate continuing to be subject to such attempts. There is an ongoing risk that some or all of our bitcoin could be lost or stolen as a result of one or more of these security incidents. As we increase in size, and threat actors become increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and remove forensic evidence, we may become a more appealing target of hackers, malware, cyber-attacks or other security threats. We may also be unable to detect, investigate, remediate or recover from future attacks or incidents and eliminate all such vulnerability. For example, we provide cybersecurity training for employees, but we cannot guarantee that we will not be affected by further phishing attempts.

Read in the 10-K filed Feb 25, 2025 ↗

Additionally, we may not be able to ensure the adequacy of our security measures or those employed by third parties, including our mining pool service providers, custodians or other counterparties. Our business operations and reputation depend on our ability to maintain the confidentiality, integrity and availability of data, digital assets and systems related to our business, personal information, proprietary technologies, processes and intellectual property (“Confidential Information”). We, our business and commercial partners rely extensively on third-party service providers’ information technology, computer systems, hardware, software, technology infrastructure and online sites and networks (collectively, “IT Systems”), including renewable energy infrastructure, cloud-based systems and on-premises servers (i.e., data centers), to record and process transactions and manage our operations, among other matters. We and our third-party service providers, partners, custodians and collaborators, may experience failures of, or disruptions to, IT systems and may be subject to attempted and successful security breaches or cybersecurity incidents. Efforts to limit the ability of malicious actors to disrupt the operations of the internet or undermine our own security efforts may be costly to implement and may not be successful. Such incidents, whether attributable to a vulnerability in our or third party IT Systems, or otherwise, could result in claims of liability against us, damage our reputation and materially harm our business. Remote and hybrid working arrangements at our company, and at many third-party providers, also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of artificial intelligence in our or any service providers’ or partners’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges.

Read in the 10-K filed Feb 25, 2025 ↗

Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information, may adversely affect our business or our reputation and could have a material adverse effect on our financial condition. In addition, we face numerous and evolving cybersecurity risks, including from diverse threat actors, such as state-sponsored organizations, opportunist hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, or other unscrupulous third parties who develop and deploy viruses and other malicious software programs that could attack our IT Systems and Confidential Information. In the case of such a security breach, IT failure or other cybersecurity incident, we may suffer damage to our key systems and experience (i) interruption in our services, (ii) loss of ability to control or operate our equipment; (iii) misappropriation of personal data and (iv) loss of Confidential Information or other critical data that could interrupt our operations; each of which may adversely impact our reputation and brand by resulting in significant incident response, system restoration or remediation and future compliance costs and expose us to increased risks of governmental and regulatory investigations, enforcement actions, legal claims or proceedings (such as class actions), fines and penalties, and other liability, any of which could adversely affect our business. A data breach or security incident may also trigger mandatory data breach notification obligations under applicable privacy and data protection laws, which, if applicable, could lead to widespread negative publicity and a loss in confidence regarding the effectiveness of our data security measures. Furthermore, mitigating the risk of future attacks or IT Systems failures have resulted, and could in the future result, in additional operating and capital costs in systems technology, personnel, monitoring and other investments. In addition, insurers are currently reluctant to provide cybersecurity insurance for digital assets and cryptocurrency assets and we do not currently hold cybersecurity insurance. Therefore, in the event of any such actual or potential incidents, our costs and resources devoted and any impacted assets may not be partially or fully recoverable.

Read in the 10-K filed Feb 25, 2025 ↗

We and our third-party service providers, partners and collaborators, may in the future experience failures of, or disruptions to, IT systems and may be subject to attempted and successful security breaches or data security incidents. Security breaches or data security incidents experienced by us or our third-party service providers, manufacturers, joint collaborators, or other business or commercial partners, can vary in scope and intent from economically-driven attacks to malicious attacks targeting our key operating systems with the intent to disrupt, disable or otherwise cripple our operations. This can include any combination of phishing attacks, malware, ransomware attacks, insider threats or viruses targeted at our key systems and IT systems as well as those of our third-party service providers. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target, and we may not be able to implement adequate preventative measures. Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means. A successful security breach or security incident may target us directly, or indirectly target or impact us through our third-party service providers, manufacturers, joint collaborators, or other business or commercial partners. A security breach or other security incident at a third-party service provider’s location or ours, or within a third-party service provider’s systems or ours, could affect our control over personal or confidential information or negatively impact our operations and ability to earn revenue.

Read in the 10-K filed Feb 25, 2025 ↗

The inadvertent disclosure of or unauthorized access to IT systems, networks and data, including personal information, confidential information and proprietary information, may adversely affect our business or our reputation and could have a material adverse effect on our financial condition. In addition, undiscovered vulnerabilities in our equipment or services could expose us to hackers or other unscrupulous third parties who develop and deploy viruses and other malicious software programs that could attack our equipment services and business. In the case of such a security breach, security incident or other IT failure, we may suffer damage to our key systems and experience (i) interruption in our services, (ii) loss of ability to control or operate our equipment; (iii) misappropriation of personal data and (iv) loss of critical data that could interrupt our operations, which may adversely impact our reputation and brand and expose us to increased risks of governmental and regulatory investigation and enforcement actions, private litigation and other liability, any of which could adversely affect our business. A security breach may also trigger mandatory data breach notification obligations under applicable privacy and data protection laws, which, if applicable, could lead to widespread negative publicity and a loss in confidence regarding the effectiveness of our data security measures. Furthermore, mitigating the risk of future attacks or IT systems failures have resulted, and could in the future result, in additional operating and capital costs in systems technology, personnel, monitoring and other investments. In addition, insurers are currently reluctant to provide cybersecurity insurance for digital assets and cryptocurrency assets and we do not currently hold cybersecurity insurance. Therefore, in the event of any such actual or potential incidents, our costs and resources devoted and any impacted assets may not be partially or fully recoverable. Most of our sensitive and valuable data, including digital assets, are stored with third-party custodians and service providers. Therefore, we rely on the digital asset community to optimize and protect sensitive and valuable data and identify vulnerabilities. There can be no guarantee that these measures and the work of the digital asset developer community will identify all vulnerabilities, errors and defects, or will resolve all vulnerabilities, errors and defects, prior to a malicious actor being able to utilize them. Any actual or perceived data security breach at any of those third-party custodians or service providers could lead to theft or irretrievable loss of our fiat currencies or digital assets, which may or may not be covered by insurance maintained by us or our third-party custodians or service providers.

Read in the 10-K filed Feb 25, 2025 ↗

The storage and custody of our bitcoin assets are subject to cybersecurity breaches, hacking, fraud risks and restriction on access, and we may not have adequate sources of recovery if our bitcoin assets are lost, stolen or destroyed.

Read in the 10-K filed Feb 25, 2025 ↗

There is a risk that some or all of our bitcoin assets could be subject to cybersecurity breaches, hacking, fraud risks and restriction on access, and we may not have adequate sources of recovery if our bitcoin assets are lost, stolen or destroyed. Hackers or malicious actors may launch attacks to steal or compromise cryptocurrencies, such as by attacking the cryptocurrency network source code, exchanges, miners, third-party platforms, cold and hot storage locations or software, or by other means.

Read in the 10-K filed Feb 25, 2025 ↗

We primarily use Coinbase Prime as our custodian to store our bitcoin, but also use other custodians to reduce the risk of loss. We rely on our custodians’ security systems to safeguard our bitcoin holdings from theft, loss, destruction or other issues relating to hackers and technological attack. There can be no assurance that these custody services are more secure than self-storage or other alternatives. Human error and the constantly evolving state of cybercrime and hacking techniques may render present security protocols and procedures ineffective in ways which we cannot predict. Additionally, if our bitcoin holdings are lost, stolen or destroyed under circumstances rendering a party, such as our custodians, liable to us, the responsible party may not have the financial resources sufficient to satisfy our claim. For example, as to a particular event of loss, the only source of recovery for us might be limited, to the extent identifiable, to other responsible third parties (e.g., a thief or terrorist), any of which may not have the financial resources (including liability insurance coverage) to satisfy a valid claim of ours.

Read in the 10-K filed Feb 25, 2025 ↗

Digital asset trading platforms may also be subject to increased regulation and there is a risk that increased compliance costs are passed through to users, including us, as we exchange bitcoin earned through our mining activities. There is a risk that a lack of stability in the bitcoin exchange market and the closure or temporary shutdown of bitcoin exchanges due to fraud, business failure, hackers or malware, or government-mandated restrictions may reduce confidence in the Bitcoin network and result in greater volatility in or suppression of bitcoin’s value and consequently have an adverse impact on our operations and financial performance. Although bitcoin is not currently treated as a security by the SEC, the exchanges on which bitcoin is traded typically provide trading services with respect to numerous other cryptocurrencies and digital assets, some of which may be deemed to be securities by the SEC, and some of them are currently under investigation by other regulators as well. If any of these exchanges are shut down due to regulatory action, it could become more difficult to us and for other holders of bitcoin to monetize our holdings. This could also result in a decrease in the overall price of bitcoin.

Read in the 10-K filed Feb 25, 2025 ↗

Additionally, a perceived lack of stability in the digital asset exchange market and the closure or temporary shutdown of digital asset exchanges due to business failure, hackers or malware, government-mandated regulation, or fraud, may reduce confidence in digital asset networks and result in greater volatility in cryptocurrency values. These potential consequences of a digital asset exchange’s failure could adversely affect an investment in us.

Read in the 10-K filed Feb 25, 2025 ↗

Threats to network and data security are increasingly diverse and sophisticated. Security breaches, computer malware and computer hacking attacks have been a prevalent concern in our businesses. Despite our efforts and processes to prevent these, our computer servers and computer systems may be vulnerable to cybersecurity risks, including denial-of-service attacks, physical or electronic break-ins, employee theft or misuse and similar disruptions from unauthorized tampering with our computer servers and computer systems. The preventive actions we take to reduce the risk of cyber incidents and protect our information technology and networks may be insufficient to repel a major cyber-attack in the future. To the extent that any disruption or security breach results in a loss or damage to our network, in unauthorized disclosure of confidential information or in a loss of our digital assets, it could cause significant damage to our reputation, lead to claims against us and ultimately have a material adverse effect on our business, financial condition and results of operations. Additionally, we may be required to incur significant costs to protect against damage caused by these disruptions or security breaches in the future.

Read in the 10-K filed Feb 27, 2025 ↗

To the extent that digital asset exchanges or other trading venues are involved in fraud or experience security failures or other operational issues, a reduction in digital asset prices could occur. Digital asset market prices depend, directly or indirectly, on the prices set on exchanges and other trading venues, which are new and, in most cases, largely unregulated as compared to established, regulated exchanges for securities, derivatives and other currencies. For example, during the past three years, a number of bitcoin exchanges have been closed due to fraud, business failure or security breaches. In many of these instances, the customers of the closed bitcoin exchanges were not compensated or made whole for the partial or complete losses of their account balances in such bitcoin exchanges. While smaller exchanges are less likely to have the infrastructure and capitalization that provide larger exchanges with additional stability, larger exchanges may be more likely to be appealing targets for hackers and “malware” (i.e., software used or programmed by attackers to disrupt computer operation, gather sensitive information, or gain access to private computer systems) and may be more likely to be targets of regulatory enforcement action.

Read in the 10-K filed Feb 27, 2025 ↗

In response to these events, the digital asset markets, including the market for bitcoin specifically, have experienced price volatility and several other entities in the digital asset industry have been, and may continue to be, negatively affected, further undermining confidence in the digital asset market and in bitcoin. These events have also negatively impacted the liquidity of the digital asset market as certain entities affiliated with FTX engaged in significant trading activity. If the liquidity of the digital asset market continues to be negatively impacted by these events, digital asset prices, including the price of bitcoin, may continue to experience significant volatility and confidence in the digital asset markets may be further undermined. A perceived lack of stability in the digital asset exchange market and the closure or temporary shutdown of digital asset exchanges due to business failure, hackers or malware, government-mandated regulation, or fraud, may reduce confidence at least in part in digital asset networks and result in greater volatility in bitcoin’s value. Because the value of bitcoin is derived from the continued willingness of market participants to exchange government-issued currency that is designated as legal tender in its country of issuance through government decree, regulation, or law (“fiat” currency) for bitcoin, should the marketplace for bitcoin be jeopardized or disappear entirely, permanent and total loss of the value of bitcoin may result.

Read in the 10-K filed Feb 27, 2025 ↗

and cold storage, are reasonably designed to safeguard our bitcoin and other digital assets from theft, loss, destruction or other issues relating to hackers and technological attack. Nevertheless, the security procedures cannot guarantee the prevention of any loss due to a security breach, software defect or act of God that may be borne by us. In addition, Coinbase’s limited liability under its services agreement with us may limit our ability to recover losses relating to our bitcoin. If such digital assets are lost, stolen or destroyed under circumstances rendering a third party liable to us, it is possible that the responsible third party may not have the financial resources or insurance sufficient to satisfy any or all of our claims against the third party, or have the ability to retrieve, restore or replace the lost, stolen or destroyed digital assets due to governing network protocols and the strength of the cryptographic systems associated with such digital assets. To the extent that we are unable to recover on any of our claims against any such third party, such loss could have a material adverse effect on our business, financial condition and results of operations.

Read in the 10-K filed Feb 27, 2025 ↗

Generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. In addition, generative AI may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, and/or legal liability. For example, deficient or inaccurate recommendations, summaries, or analyses that generative AI features assist in producing could lead to customer rejection, or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of generative AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Generative AI is also the subject of a quickly evolving legal and regulatory environment, and new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications related to our use of generative AI could cause us to divert resources towards compliance and adversely affect our business, reputation, or financial results. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including the misuse of personal data, which may adversely affect our operations and reputation.

Read in the 10-K filed Mar 27, 2025 ↗

Our continued success depends on our systems, applications, and software continuing to operate and meet the changing needs of our customers and users and financial services partners. We rely on our technology and engineering staff and vendors to successfully implement changes to and maintain our systems and services efficiently and securely. Like all information systems and technology, our platform may contain or develop material errors, failures, vulnerabilities or bugs, particularly when new features or capabilities are released, and may be subject to computer viruses or malicious code, break-ins, phishing impersonation attacks, attempts to overload our servers with denial-of-service or other attacks, ransomware and similar incidents or disruptions from unauthorized use of our computer systems, as well as unintentional incidents causing data leakage, any of which could lead to interruptions, delays or shutdown of our platform.

Read in the 10-K filed Mar 27, 2025 ↗

Operating our business and products involves the collection, storage, use and transmission of large volumes of sensitive, proprietary and confidential information, including financial and personal information, pertaining to our current, prospective and past users, as well as our staff, contractors, and business partners. The security measures we take to protect this information may be breached as a result of computer malware, viruses, social engineering, ransomware attacks, account takeover attacks, hacking and cyberattacks, including by state-sponsored and other sophisticated organizations. Such incidents have become more prevalent in recent years. Our security measures could also be compromised by our personnel, theft, or errors, or be insufficient to prevent exploitation of security vulnerabilities in software or systems on which we rely. Such incidents may in the future result in unauthorized, unlawful or inappropriate use, destruction or disclosure of, access to, or inability to access the sensitive, proprietary, and confidential information that we handle. These incidents may remain undetected for extended periods.

Read in the 10-K filed Mar 27, 2025 ↗

A security breach or other security incident, or the perception that one has occurred, could result in a loss of confidence by both our users and financial services partners and damage our reputation and brand, reduce demand for our products, disrupt normal business operations, require us to expend significant capital and resources to investigate and remedy the incident and prevent a recurrence, and subject us to litigation, regulatory enforcement action, fines, penalties, and other liability, which could adversely affect our business, financial condition and results of operations. Even if we take steps that we believe are adequate to protect us from cyber threats, hacking against our competitors or other companies in our industry could create the perception among our users and financial services partners that our digital platform is not safe to use. Security incidents could also damage our IT systems and our ability to make the financial reports and other public disclosures required of public companies. These risks are likely to continue to increase as we continue to grow, process, store and transmit an increasingly larger and larger volume of data.

Read in the 10-K filed Mar 27, 2025 ↗

Most of the jurisdictions in which we operate have established their data privacy and security legal frameworks. Failure to comply with these laws can result in regulatory fines or penalties. The California borrower Privacy Act (“CCPA”) created new data privacy rights for California-resident users that will be expanded when the CPRA, which was approved in November 2020, goes into effect. In addition, Virginia recently passed the borrower Data Protection Act, which will go into effect at the same time as CPRA and many other states are considering enacting privacy laws. These laws, as well as any associated regulations, may increase our operating costs and potential liability (particularly in the event of a data breach), delay or impede the development of new products, and have a material adverse effect on our business, including how we use information about individuals, our financial condition and the results of our operations or prospects.

Read in the 10-K filed Mar 27, 2025 ↗

If the Company’s data and network infrastructure were to fail, or if the Company were to suffer an interruption or degradation of services or other infrastructure environments, it could lose important manufacturing and technical data, which could harm its business. The Company’s facilities, as well as the facilities of third parties that maintain or have access to the Company’s data or network infrastructure, are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures and similar events. If the Company’s or any third-party provider’s systems or service abilities are hindered by any of the events discussed above, the Company’s ability to operate may be impaired and its business could be adversely affected. A decision to close facilities without adequate notice, or other unanticipated problems, could adversely impact the Company’s operations. The Company’s infrastructure also could be subject to break-ins, cyber-attacks, sabotage, intentional acts of vandalism and other misconduct, from a spectrum of actors ranging in sophistication from threats common to most industries to more advanced and persistent, highly organized adversaries. Any security breach, including personal data breaches, or incident, including cybersecurity incidents, that the Company experiences could result in unauthorized access to, misuse of or unauthorized acquisition of its internal sensitive corporate data, such as financial data, intellectual property, or data related to contracts with commercial or government customers or partners. Such unauthorized access, misuse, acquisition, or modification of sensitive data may result in data loss, corruption or alteration, interruptions in the Company’s operations or damage to the Company’s computer hardware or systems or those of its employees and customers. Moreover, negative publicity arising from these types of disruptions could damage the Company’s reputation.

Read in the 10-K filed Mar 27, 2025 ↗

Threats from malicious persons and groups, new vulnerabilities and advanced new attacks against information systems create a risk of cybersecurity incidents. These incidents can include but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may not immediately produce signs of intrusion, the Company may be unable to anticipate these incidents or techniques, timely discover them or implement adequate preventative measures.

Read in the 10-K filed Mar 27, 2025 ↗

Over the past several years, cyber-attacks have become more prevalent and much harder to detect and defend against. The Company’s network and storage applications may be vulnerable to cyber-attack, malicious intrusion, malfeasance, loss of data privacy or other significant disruption and may be subject to unauthorized access by hackers, employees, consultants or other service providers. In addition, hardware, software or applications the Company develops or procures from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. Unauthorized parties may also attempt to gain access to the Company’s systems or facilities through fraud, trickery or other forms of deceiving the Company’s employees, contractors and temporary staff. As cyber threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any cybersecurity vulnerabilities. The Company does not currently have a cyber liability insurance policy and even if a policy is purchased, the Company cannot be certain that its coverage will be adequate for liabilities incurred or that insurance will continue to be available to it on economically reasonable terms, or at all.

Read in the 10-K filed Mar 27, 2025 ↗

Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruptions and delays in services and operations, which could harm our business.

Read in the 10-K filed Mar 27, 2025 ↗

Computer malware, viruses, physical or electronic break-ins and similar disruptions could lead to interruptions and delays in our services and operations and loss, misuse or theft of data. Computer malware, viruses, ransomware, hacking, phishing, and other attacks against online networks have become more prevalent and may occur on our systems in the future. We have implemented security measures, such as multi-factor authentication and security incident and event management tools. But any attempts by cyber attackers to disrupt our services or systems, if successful, could harm our business, introduce liability to data subjects, resulting in the misappropriation of funds, and be expensive to remedy and damage our reputation or brand. Insurance may not be sufficient to cover significant expenses and losses related to cyber-attacks. As cyber-attacks evolve, the cost of measures designed to prevent such attacks continues to increase, and we may not be able to cause the implementation or enforcement of such preventions with respect to our third-party vendors. Though it is difficult to determine what, if any, harm may directly result from any specific interruption or attack, any failure to maintain performance, reliability, security and availability of systems and technical infrastructure may, in addition to other losses, harm our reputation, brand and ability to attract customers.

Read in the 10-K filed Mar 27, 2025 ↗

Service disruptions, outages and other performance problems can be caused by a variety of factors, including infrastructure changes, cyber-security threats, third-party service providers, human or software errors and capacity constraints. If our services are unavailable when users attempt to access them, they may seek other services, which could reduce demand for our solutions from target customers.

Read in the 10-K filed Mar 27, 2025 ↗

Generative AI tools producing content which can be indistinguishable from that generated by humans is a relatively novel development, with benefits, risks, and liabilities still unknown. Recent decisions of governmental entities and courts (such as the U.S. Copyright Office, U.S. Patent and Trademark Office, and U.S. Court of Appeals for the Federal Circuit) interpret U.S. copyright and patent law as limited to protecting works and inventions created by human authors and inventors, respectively. We are therefore unlikely to be able to obtain U.S. copyright or patent protection for works or inventions wholly created by a generative AI tool, and our ability to obtain U.S. copyright and patent protection for source code, text, images, inventions or other materials, which are developed with some use of generative AI tools may be limited, if available at all. Likewise, the availability of such IP protections in other countries is unclear. As a result, we could have no remedy if third parties reused those same materials, or similar materials, also generated by AI tools. In addition, we may have little or no insight into the third-party content and materials used to train third party generative AI tools, or the extent of the original works which remain in the outputs. As a result, we may face claims from third parties claiming infringement of their intellectual property rights, or mandatory compliance with open-source software or other license terms, with respect to software, or other materials or content we believed to be available for use, and not subject to license terms or other third-party proprietary rights. We could also be subject to claims from the providers of the generative AI tools, if we use any of the generated materials in a manner inconsistent with their terms of use. Any of these claims could result in legal proceedings and could require us to purchase a costly license, comply with the requirement of open source software license terms, or limit or cease using the implicated software, or other materials or content unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third party materials, which could reduce or eliminate the value of our technologies and services. Any use of generative AI tools to develop source code may also present additional security risks because the generated source code may have been modelled from publicly available code, or otherwise not subject to all of our standard internal controls, which may make it easier for hackers and other third parties to determine how to breach our website and systems that rely on the code. Any of these risks could be difficult to eliminate or manage, and, if not addressed, could have a material adverse effect on our business, results of operations, financial condition, and future prospects.

Read in the 10-K filed Mar 27, 2025 ↗

The success of third-party services on the Exodus Platform is affected by a number of factors, many of which are beyond our control, such as our ability to successfully integrate services into the Exodus Platform using third-party APIs, technological changes and developments, user preferences and technical support provided by the third party. Interruptions or delays in our cloud or internal infrastructure or third-party services and cybersecurity incidents such as attacks on our information systems by malicious actors could also affect our third-party services.

Read in the 10-K filed Mar 6, 2025 ↗

Despite our efforts to protect against cybersecurity risks, the cybersecurity threat landscape is rapidly evolving and has become increasingly sophisticated, and we may not be successful in preventing or mitigating cybersecurity threats that could have a material adverse effect on us. If any of the foregoing events were to materialize, they could result in technical disruptions or errors, the loss of sensitive information, and unauthorized access to our internal systems, networks and data. Moreover, a delay in or failure to detect a cybersecurity incident, or the full extent of an incident, could exacerbate its effects. We may also be required to expend significant resources to investigate and remediate vulnerabilities or other identified risks, costs which may not fully be covered by insurance coverage or indemnified by other means.

Read in the 10-K filed Mar 6, 2025 ↗

Over the past several years, a number of digital asset trading platforms have been closed or faced issues due to fraud, failure, security breaches or governmental regulations. Particularly for operators outside of the United States, digital asset trading platforms are not regulated in ways similar to national securities exchanges and other highly regulated trading environments or, if subject to regulation in a relevant jurisdiction, may not be in compliance. As a result, capital requirements, clearing infrastructure and technical and operational security requirements may vary. The nature of the digital assets held at trading platforms makes them appealing targets for hackers and a number of digital asset trading platforms have been victims of cybercrimes. It is possible that the customers of such digital asset trading platforms may not be compensated or made whole for the partial or complete losses of their account balances in such trading platforms.

Read in the 10-K filed Mar 6, 2025 ↗

Digital asset platforms are relatively new, and many are unlicensed, may be subject to regulation in a relevant jurisdiction but may not be in compliance, are unregulated, or may operate without supervision by any governmental authorities, and do not provide the public with significant information regarding their management team, corporate practices, cybersecurity, and regulatory compliance. To the extent that unanticipated operational or trading problems or other failures, such as security or technical failures, arise on trading platforms or the Exodus Platform, customers, users and the general public may lose confidence or interest in digital asset platforms, including the Exodus Platform, which could have an adverse impact on our business and our customers’ perception of us, including decreased use of our platform and loss of customer demand for our products and services.

Read in the 10-K filed Mar 6, 2025 ↗

Certain supported digital assets enable holders to earn rewards by participating in decentralized governance, bookkeeping and transaction confirmation activities on their underlying blockchain networks, such as through staking activities, including staking through validation, delegating and baking. Staking allows users to “stake” supported digital assets held in their Exodus wallets by participating in blockchain validation through a third-party API Provider, Everstake. Everstake currently provides and is expected to continue to provide such services for certain supported crypto assets to our users in order to enable them to earn rewards based on crypto assets held in their Exodus wallets. Everstake’s network may further require customer assets to be transferred into smart contracts on the underlying blockchain networks not under Everstake’s or anyone’s control. If Everstake or smart contracts fail to operate as expected, suffer cybersecurity attacks, experience security issues or encounter other problems, our users’ assets may be irretrievably lost. In addition, certain blockchain networks dictate requirements for

Read in the 10-K filed Mar 6, 2025 ↗

Our API Providers and the third parties with whom they contract may be subject to financial, legal, regulatory, and labor issues, cybersecurity incidents, disruptions, interruptions, and other misconduct of which we are not aware. Should any of the foregoing materialize and lead to disruptions or issues in third party operations, risks to our users may include loss of information stored with or provided to the API Provider, along with loss of access to the digital assets or fiat currency used in any pending transaction with the API Provider. In such instances, because we do not control the operations of any of our API Providers or third parties with which they contract, we will be unable to intervene and can make no assurances as to the outcome of any issue or dispute between the user and API Provider. In these scenarios, users may blame or become dissatisfied with the Exodus Platform as a result of these negative experiences, which could adversely affect our ability to access or sell our digital services and subject us to legal or regulatory scrutiny, reputational harm and significant financial losses.

Read in the 10-K filed Mar 6, 2025 ↗

Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cyber-security.

Read in the 10-K filed Mar 25, 2025 ↗

increased exposure to cybersecurity risks in foreign jurisdictions that may materially and adversely affect our business, financial condition and results of operations.

Read in the 10-K filed Mar 3, 2025 ↗

Bitcoin and other blockchain-based digital assets have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. A successful security breach or cyberattack on us or our custodians could result in a partial or total loss of our Bitcoin in a manner that may not be covered by insurance or indemnity provisions of the custody agreement with a custodian who holds our Bitcoin. Access to our Bitcoin could also be restricted by natural events (such as an earthquake or flood) or human actions (such as a terrorist attack). Such a loss could have a material adverse effect on our business, financial condition, and results of operations.

Read in the 10-K filed Mar 3, 2025 ↗

Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Sep 26, 2025 ↗

•Our bitcoin lending arrangements expose us to risks of borrower default, operational failures and cybersecurity threats;

Read in the 10-K filed Mar 3, 2025 ↗

Our bitcoin lending arrangements expose us to risks of borrower default, operational failures and cybersecurity threats.

Read in the 10-K filed Mar 3, 2025 ↗

Our business and operations would be adversely impacted in the event of a failure or interruption of our information technology infrastructure or as a result of a cybersecurity attack.

Read in the 10-K filed Mar 28, 2025 ↗

If our third-party digital asset-focused custodian experiences a security breach or cyber-attack and unauthorized parties obtain access to our Bitcoin, we may lose some or all of our Bitcoin and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Feb 28, 2025 ↗

Until we can generate a sufficient amount of revenue to finance our capital needs, which we may never achieve, we expect to finance our cash needs primarily through public or private equity financings or conventional debt financings. We cannot be certain that additional funding will be available on acceptable terms, or at all. If we are not able to secure additional funding when needed to support our business growth and to respond to business challenges, track and comply with applicable laws and regulations, develop new technology and services or enhance our existing offering, improve our operating infrastructure, enhance our information security systems to combat changing cyber threats and expand personnel to support our business, we may have to delay or reduce the scope of future growth initiatives. Moreover, any additional equity financing that we obtain may dilute the ownership held by our existing shareholders. The economic dilution to our shareholders will be significant if our stock price does not materially increase, or if the effective price of any sale is below the price paid by a particular shareholder. Any debt financing could involve substantial restrictions on activities and creditors could seek additional pledges of some or all of our assets. If we fail to obtain additional funding as needed, we may be forced to cease or scale back operations, and our results, financial conditions and stock price would be adversely affected.

Read in the 10-K filed Mar 14, 2025 ↗

In addition, the new EU-wide General Data Protection Regulation, or GDPR, became applicable on May 25, 2018, replacing the data protection laws of each EU member state. The GDPR implemented more stringent operational requirements for processors and controllers of personal data, including, for example, expanded disclosures about what and how personal information is to be used, limitations on retention of information, increased requirements to erase an individual’s information upon request, mandatory data breach notification requirements and higher standards for data controllers to demonstrate that they have obtained valid consent from individuals to process their personal data (or reliance on another appropriate legal basis) for certain data processing activities. It also significantly increased penalties for noncompliance, including where the Company may act as a data processor.

Read in the 10-K filed Mar 14, 2025 ↗

Although we continue to review and improve our policies and procedures with respect to data protection and privacy to ensure compliance with applicable laws, rules and regulations, if our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to fines, litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data or our marketing practices, or other liabilities, such as compensation claims by individuals affected by a personal data breach, as well as negative publicity and a potential loss of business. Compliance with data protection and privacy laws and regulations will become more complex, time intensive and costly as we grow, particularly when we begin to rely on the movement of data across national boundaries.

Read in the 10-K filed Mar 14, 2025 ↗

SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

Read in the 10-K filed Mar 14, 2025 ↗

We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.

Read in the 10-K filed Mar 14, 2025 ↗

Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing and changing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office. Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.

Read in the 10-K filed Mar 14, 2025 ↗

We also require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.

Read in the 10-K filed Mar 14, 2025 ↗

One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk-oversight function as a whole, as well as through the Audit Committee.

Read in the 10-K filed Mar 14, 2025 ↗

Our Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur. They will provide periodic briefings, as required, to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.

Read in the 10-K filed Mar 14, 2025 ↗

Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled “Risk Factors” included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.

Read in the 10-K filed Mar 14, 2025 ↗

Our risk management processes and procedures seek to appropriately balance risk and return and mitigate risks. We have established processes and procedures intended to identify, measure, monitor and control the types of risk to which we are subject, including credit risk, market risk, liquidity risk, operational risk, compliance risk, legal risk, strategic risk, and reputational risk. Credit risk is the risk of loss that arises when an obligor fails to meet the terms of an obligation. We are exposed to both consumer credit risk, from our customer loans, and institutional credit risk, principally from our partners. Market risk refers to the risk that a change in the level of one or more market prices, rates, indices, correlations or other market factors will result in losses for a position or portfolio. Liquidity risk is the risk that financial condition or overall safety and soundness are adversely affected by an inability, or perceived inability, to meet obligations and support business growth. Operational risk is the risk of loss arising from inadequate or failed processes, people or systems, external events (e.g., natural disasters and cybersecurity incidents), reputational matters and includes those risks as they relate directly to us as well as to third parties with whom we contract or otherwise do business. Compliance risk is the risk of non-compliance with applicable laws, rules, regulations, other supervisory guidance, and internal policies, and also includes any of those risks as they relate directly to us and our subsidiaries, as well as to third parties with whom we contract or otherwise do business. Legal risk is the risk of potential disputes, litigation, defective agreements or unprotected or infringed rights that can disrupt or otherwise negatively affect operations or condition of the organization. Strategic risk is the risk from changes in the business environment, improper implementation of decisions or inadequate responsiveness to changes in the business environment. Reputational risk is the risk arising from negative perception on the part of stakeholders, including customers, counterparties, shareholders, investors, rating agencies, regulators and employees that can adversely affect the Company’s ability to maintain existing talent and customers and establish new business relationships with continued access to sources of funding. See “Our Business—Credit Risk Management” and “Risks—Risk Management” for additional information on the types of risks affecting our business.

Read in the 10-K filed Feb 7, 2025 ↗

We rely on the well-known U.S. based third-party digital asset-focused custodian, NYDIG, to safeguard our bitcoin using cold storage. NYDIG receives and holds our custodied assets, which includes both our digital assets and any cash we may choose to custody with NYDIG. Only NYDIG holds the private keys to our wallet, and no one at the Company has access to our wallet’s private keys. If our third-party service provider experiences a security breach or cyber-attack and unauthorized parties obtain access to our bitcoin, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected. To date, we have not experienced a material cyber incident; however, we continue to encounter ongoing cyber-attacks and the occurrence of any such event in the future could subject us to liability to our customers, suppliers, business partners and others, or give rise to legal and/or regulatory action, which could damage our reputation or otherwise materially harm our business, operating results, and financial condition.

Read in the 10-K filed Mar 3, 2025 ↗