- A São Paulo court ordered Coinbase to repay about $100,000 to a customer whose crypto vanished from a Coinbase Wallet.
- The court applied Brazil’s Consumer Protection Code, faulting Coinbase for failing to prove the user authorized the transfer or that basic security existed.
- Lawyers say the decision could set a precedent that wallet developers face liability for user security across Brazil, one of the world’s largest crypto markets.
A São Paulo court has ordered Coinbase (NASDAQ: COIN) to return roughly $100,000 to a customer whose crypto disappeared from a Coinbase Wallet.
The court rejected the exchange’s argument that self-custody shields it from liability when user funds are stolen.
Court throws out Coinbase defense
Brazilian courts may begin holding wallet software makers responsible for user security after the São Paulo State Court (TJSP) told Coinbase to repay about 507,000 reais ($100,000) to an investor called Joubert.
Joubert moved his crypto from other exchanges into Coinbase’s app, and the funds later vanished with no prior authorization from him.
Coinbase’s defense was that it didn’t have the private keys to the wallet and that it had no power over transactions recorded on the blockchain.
Magistrate Ju Hyeon Lee applied Brazil’s Consumer Protection Code, under which Coinbase had to prove that Joubert had actually authorized the transfer; it could not.
The company also couldn’t prove that the drained wallet had basic security measures like blocking tools and two-factor authentication.
The judge further criticized the company for submitting complicated technical records without translating them into terms the court could understand.
Coinbase was ordered to repay the full sum along with legal. It also has to pay court costs equal to 10% of the claim.
Could Coinbase’s case set a precedent?
Raphael Souza, a lawyer who focuses on digital law, said the court’s ruling destroys two arguments crypto platforms often use in court.
The first argument is that self-custody products carry no liability for the maker.
“Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it,” Souza said.
The second argument is that companies can bury judges in technical documents submitted as case files and expect them to figure it out alone.
Brazil’s legal system has been moving toward stronger consumer protection. The country’s Superior Court of Justice already has cases holding crypto platforms responsible for fraud if they cannot prove proper security.
Brazil’s central bank also reclassified virtual asset service providers as Type 3 institutions under Resolution 580/2026, placing them under the same rules as securities brokerages starting January 1, 2027, Cryptopolitan reported. The country processed about $318 billion in crypto transactions from mid-2024 to mid-2025.
What other security problems has Coinbase faced?
Apart from the Joubert case, the exchange has been having security-related problems involving fraud. Cryptopolitan reported in December 2025 that on-chain investigator ZachXBT traced roughly $2 million in thefts to a single scammer posing as Coinbase support.
Separately, Brooklyn prosecutors charged a 23-year-old man with stealing $16 million from about 100 Coinbase users through impersonation calls.
Many of those scams were a result of a May 2025 breach in which bribed overseas support agents leaked customer data. Coinbase disclosed that attackers demanded a $20 million ransom and threatened to publish records on nearly 70,000 customers.
The company’s CEO Brian Armstrong said the company put that same $20 million toward a bounty instead.
Now, Coinbase could either appeal the court’s decision or pay the assigned fees.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
How much was Coinbase ordered to pay, and to whom?
Coinbase was ordered to return roughly 507,000 reais, about $100,000, plus legal interest to a customer identified as Joubert, whose funds disappeared from a Coinbase Wallet without his authorization. The company was also charged court costs equal to 10% of the claim.
Why did Coinbase's self-custody defense fail?
Under Brazil's Consumer Protection Code, the burden of proof fell on Coinbase, and the company could not show that the user authorized the transaction or that security measures such as two-factor authentication were in place. Magistrate Ju Hyeon Lee also faulted Coinbase for submitting raw technical records without a clear explanation.
Why could this ruling matter beyond one case?
The decision may set a precedent that developers of self-custody wallets can be held liable for user security, even when they only provide the software and never control the private keys.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
