São Paulo Court Orders Coinbase to Repay $100,000 in Wallet Theft Case

Court Rejects Self-Custody Liability Defense

The São Paulo State Court decided against Coinbase in a case involving an investor identified as Joubert. The user transferred digital assets into a Coinbase Wallet only to discover later that unauthorized transactions had emptied the holdings. The court ordered the company to repay approximately 507,000 reais, equivalent to around $100,000, plus court costs amounting to 10% of the claim.

Coinbase argued that it did not control the wallet's private keys and therefore bore no responsibility for the losses. Judge Ju Hyeon Lee applied provisions from Brazil’s Consumer Protection Code, which placed the burden on the company to demonstrate that the user had authorized the transfers. The exchange could not provide such evidence.

The ruling also noted Coinbase's failure to show that the wallet included basic security features such as blocking mechanisms or two-factor authentication. The judge expressed dissatisfaction with the technical documents submitted, which lacked clear explanations suitable for court review.

Legal Expert Views on the Decision

Digital law attorney Raphael Souza described the outcome as significant for how courts view responsibility in self-custody products. He stated that providers must ensure product security regardless of the technical setup behind it.

Souza further noted that companies cannot rely solely on complex documentation without proper explanation to judges. The decision requires Coinbase to cover the full amount along with applicable legal interest.

Context of Brazilian Crypto Regulations

This case arrives amid broader changes in Brazil’s approach to digital assets. Starting January 1, 2027, virtual asset service providers will fall under stricter oversight as Type 3 institutions, aligned with regulations for securities brokerages. The country recorded substantial crypto transaction volumes between mid-2024 and mid-2025.

Coinbase Security Incidents

The company has dealt with multiple security-related matters. In one instance, on-chain investigator ZachXBT linked stolen funds to impersonation scams. Prosecutors in Brooklyn charged an individual with stealing millions from Coinbase users through fraudulent support calls. A May 2025 data breach involved overseas agents leaking customer information, leading to ransom demands that the company addressed through a bounty program instead of payment.

Coinbase, a publicly traded U.S. company, now faces the choice of appealing the São Paulo ruling or fulfilling the ordered payments.