São Paulo Court Rules Against Coinbase in Landmark Case Over $100K Self-Custody Hack
The São Paulo State Court has ruled against Coinbase in a case that could set a significant precedent for liability in the self-custody cryptocurrency wallet industry.
The court ordered Coinbase to return nearly $100,000 to a user who deposited the funds into a Coinbase wallet, citing Brazil’s Customer Protection Code. The code places the burden of proof on the business providing the service.
The customer claimed the funds disappeared from their wallet without authorization. Coinbase argued it was not involved because the wallet’s private key was under the user’s full control.
However, Coinbase failed to prove that the wallet holder initiated the transaction and did not demonstrate the existence of security measures to prevent the loss.
Raphael Souza, a cryptocurrency attorney, told Portal do Bitcoin that the ruling dismantles two common arguments by crypto companies. “The first is that a self-custody portfolio does not generate liability. Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it.”
Souza noted that this applies to Coinbase because it is a registered company in Brazil.
The second argument is that technical documents alone are insufficient if companies fail to provide thorough explanations aiding court understanding. Magistrate Ju Hyeon Lee criticized Coinbase on this point.
“Coinbase had every opportunity to prove that the investor authorized the transaction, explain the technical records, and inform where the funds went. It chose not to do any of that,” Souza concluded.
As the amount presented by the user was not contested, Coinbase was ordered to return the full amount plus legal interest.
The decision establishes a precedent for liability affecting companies that provide self-custody tools, even if they are only involved as software providers.