São Paulo court orders Coinbase to repay $100K over hacked wallet

A São Paulo court has ordered Coinbase (NASDAQ: COIN) to return roughly $100,000 to a customer whose crypto disappeared from a Coinbase Wallet. 

The court rejected the exchange’s argument that self-custody shields it from liability when user funds are stolen.

Court throws out Coinbase defense 

Brazilian courts may begin holding wallet software makers responsible for user security after the São Paulo State Court (TJSP) told Coinbase to repay about 507,000 reais ($100,000) to an investor called Joubert. 

Joubert moved his crypto from other exchanges into Coinbase’s app, and the funds later vanished with no prior authorization from him.

Coinbase’s defense was that it didn’t have the private keys to the wallet and that it had no power over transactions recorded on the blockchain. 

Magistrate Ju Hyeon Lee applied Brazil’s Consumer Protection Code, under which Coinbase had to prove that Joubert had actually authorized the transfer; it could not. 

The company also couldn’t prove that the drained wallet had basic security measures like blocking tools and two-factor authentication. 

The judge further criticized the company for submitting complicated technical records without translating them into terms the court could understand. 

Coinbase was ordered to repay the full sum along with legal. It also has to pay court costs equal to 10% of the claim.

Could Coinbase’s case set a precedent? 

Raphael Souza, a lawyer who focuses on digital law, said the court’s ruling destroys two arguments crypto platforms often use in court. 

The first argument is that self-custody products carry no liability for the maker. 

“Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it,” Souza said. 

The second argument is that companies can bury judges in technical documents submitted as case files and expect them to figure it out alone. 

Brazil’s legal system has been moving toward stronger consumer protection. The country’s Superior Court of Justice already has cases holding crypto platforms responsible for fraud if they cannot prove proper security. 

Brazil’s central bank also reclassified virtual asset service providers as Type 3 institutions under Resolution 580/2026, placing them under the same rules as securities brokerages starting January 1, 2027, Cryptopolitan reported. The country processed about $318 billion in crypto transactions from mid-2024 to mid-2025.

What other security problems has Coinbase faced? 

Apart from the Joubert case, the exchange has been having security-related problems involving fraud. Cryptopolitan reported in December 2025 that on-chain investigator ZachXBT traced roughly $2 million in thefts to a single scammer posing as Coinbase support. 

Separately, Brooklyn prosecutors charged a 23-year-old man with stealing $16 million from about 100 Coinbase users through impersonation calls. 

Many of those scams were a result of a May 2025 breach in which bribed overseas support agents leaked customer data. Coinbase disclosed that attackers demanded a $20 million ransom and threatened to publish records on nearly 70,000 customers. 

The company’s CEO Brian Armstrong said the company put that same $20 million toward a bounty instead. 

Now, Coinbase could either appeal the court’s decision or pay the assigned fees.

The smartest crypto minds already read our newsletter. Want in? Join them.