Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

528 paragraphs · Services-Computer Programming, Data Processing, Etc. show all sectors

The Company may also be susceptible to cybersecurity threats through its third-party service providers. For example, our independent public accounting firm was subject to a data breach and, while there is no determination of the effect on the Company of the breach, the Company continues to evaluate such effects.

Read in the 10-K filed Feb 27, 2026 ↗

Cronos’ value and trading liquidity are closely associated with the reputation of and interest in the Cronos blockchain ecosystem and its sponsors and service providers, such as Crypto.com. Adverse developments involving those parties—including business setbacks, policy changes, cybersecurity incidents, or regulator actions related to the Cronos network—could reduce demand for Cronos, restricting trading venues, or negatively affecting perceptions of the token and the Cronos network.

Read in the 10-K filed Feb 27, 2026 ↗

Negative perception, a lack of stability in the broader bitcoin markets and the closure, temporary shutdown or operational disruption of bitcoin trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the bitcoin ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in bitcoin and the broader bitcoin ecosystem and greater volatility in the price of bitcoin. For example, in 2022, each of Celsius Network, Voyager Digital, Three Arrows Capital, FTX, and BlockFi filed for bankruptcy, following which the market prices of bitcoin and other digital assets significantly declined. In addition, in June 2023, the SEC announced enforcement actions against Coinbase, Inc., and Binance Holdings Ltd., two providers of large trading venues for digital assets, which similarly was followed by a decrease in the market price of bitcoin and other digital assets. These were followed in November 2023, by an SEC enforcement action against Payward Inc. and Payward Ventures Inc., together known as Kraken, another large trading venue for digital assets. Although these complaints were ultimately dismissed, the SEC or other regulatory agencies may initiate similar actions in the future. As the price of our listed securities is affected by the value of our bitcoin holdings, the failure of a major participant in the bitcoin ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Feb 27, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin or Cronos, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our digital assets and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Feb 27, 2026 ↗

Substantially all of the bitcoin and Cronos we own will be held in custody accounts at institutional-grade digital asset custodians. Security breaches and cyberattacks are of particular concern with respect to our digital assets. Digital assets such as bitcoin and Cronos, and the entities that provide services to participants in the broader blockchain ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. In 2025, Coinbase reported that criminals bribed certain of its non-U.S. employees to steal customer data to use in social engineering attacks. A successful security breach or cyberattack could result in:

Read in the 10-K filed Feb 27, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader digital asset blockchain ecosystem, including bitcoin and Cronos networks to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to digital assets, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. Emerging risks, such as AI-driven cyberattacks and the potential for quantum computing, could introduce new vulnerabilities in our systems, potentially rendering traditional cryptographic techniques less effective and exposing us to more sophisticated forms of cyberattacks. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. Novel methods, such as those utilizing AI or quantum computing, may be even more difficult to detect and defend against. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements since the onset of the COVID-19 pandemic. The risk of cyberattacks could also be increased by cyberwarfare in connection with geopolitical conflicts, such as the ongoing Russia-Ukraine conflict, including potential proliferation of malware into systems unrelated to such conflicts. As of the date of this Annual Report, neither we nor any of our service providers has experienced a security breach or cyberattack that has materially impacted our digital asset holdings, financial condition or operating results; however, any future breach of our operations or those of our service providers or others in the digital asset industry could materially and adversely affect our business.

Read in the 10-K filed Feb 27, 2026 ↗

Bitcoin and Cronos are controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the digital assets are held. While the blockchain ledger relevant to such assets requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the digital assets held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the digital assets held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. The bitcoin and blockchain ledger, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities.

Read in the 10-K filed Feb 27, 2026 ↗

Cyber-attacks continue to evolve in sophistication, frequency and volume, including as threat actors exploit generative and agentic AI to discover and exploit vulnerabilities at unprecedented speed and scale, and may be difficult to detect for long periods of time. Our protective measures, and those of the third parties to which we are connected, may not be effective, and a failure by our clients or third-party providers to notify us of an incident in a timely manner could delay our response and increase the resulting harm. As a result, we may not be able to anticipate, prevent or detect all attacks, and we are exposed to heightened risks of cyber-attacks or other security incidents. In addition, future advances in computing, including quantum computing, could weaken or render obsolete the encryption and other security measures on which we and our third parties rely, including through the potential future decryption of data captured today.

Read in the 10-K filed Oct 20, 2026 ↗

efforts will be successful. Our business and operations span numerous geographies around the world and involve thousands of employees, contractors, vendors, developers, partners, and other third parties, including AI and cloud services. At any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our security efforts.

Read in the 10-K filed Jan 29, 2026 ↗