The fact that the listing was approved is immaterial to whether the business is breaking securities law. The SEC is not required to verify that you are running a legitimate business before allowing you to IPO. They are only required to confirm that the data in the forms you mentioned represents your business correctly.
The Coinbase S1 admits this explicitly: they explicitly list the risk of their business model being contested by the SEC later in the document that the SEC approved.
The Coinbase S1 admits this explicitly: they explicitly list the risk of their business model being contested by the SEC later in the document that the SEC approved.