Coinbase faces a São Paulo court order requiring it to return 507,000 reais, or roughly $100,000, to a customer whose cryptocurrency disappeared from a Coinbase Wallet.
The São Paulo State Court rejected the company’s claim that self-custody removed its responsibility for unauthorized losses.
Applying Brazil’s Consumer Protection Code, the court required Coinbase to prove the customer approved the disputed transfer.
Court Rejects Coinbase Self-Custody Defense
The investor, identified as Joubert, moved cryptocurrency from other exchanges into Coinbase’s wallet application. The assets later vanished without his prior authorization.
Coinbase argued that it did not hold the wallet’s private keys or control transactions recorded on the blockchain.
Magistrate Ju Hyeon Lee ruled that the company still had to show Joubert authorized the transfer. Coinbase did not provide that proof.
The court also found that Coinbase failed to demonstrate basic security measures, including blocking tools and two-factor authentication.
The judge criticized the company for submitting complex technical records without explaining them in language the court could understand.
Coinbase must repay the full amount, cover legal expenses, and pay court costs equal to 10% of the claim.
Ruling Tests Wallet Developer Liability
Digital law attorney Raphael Souza said the decision challenges two defenses used by cryptocurrency platforms and could shape wallet developer liability across Brazil.
The first is that makers of self-custody products carry no responsibility for user losses. “Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it,” Souza said.
The second is that companies can submit highly technical documents and expect judges to interpret them without clear explanations.
Brazil’s Superior Court of Justice has held crypto platforms responsible for fraud when they cannot demonstrate adequate security.
The central bank also classified virtual asset service providers as Type 3 institutions under Resolution 580/2026. From January 1, 2027, they will face rules applied to securities brokerages.
Brazil processed about $318 billion in crypto transactions from mid-2024 to mid-2025, making it one of the world’s largest cryptocurrency markets.
Coinbase Faces Wider Security Scrutiny
The ruling follows other fraud and security cases involving Coinbase users. In December 2025, on-chain investigator ZachXBT traced about $2 million in thefts to one scammer impersonating Coinbase support.
Brooklyn prosecutors charged a 23-year-old man with stealing $16 million from about 100 Coinbase users through impersonation calls.
Many scams followed a May 2025 breach in which bribed overseas support agents leaked customer data. Attackers demanded a $20 million ransom and threatened to publish records covering nearly 70,000 customers.
Chief executive Brian Armstrong said Coinbase directed the same $20 million toward a bounty instead. The company can appeal the São Paulo ruling or pay the ordered amount and fees.
