São Paulo Court Rules Against Coinbase in Landmark Case Over $100K Self-Custody Hack

The ruling, which went against Coinbase even though it did not control the user’s wallet, might establish a precedent for liabilities affecting companies providing self-custody tools, even if they are only involved as software providers.

Key Takeaways

• A Brazil court ordered Coinbase to return $100K to a user after unauthorized wallet transactions occurred.
• Coinbase lost after failing to prove the user sent the funds or that basic wallet security existed.
• This decision sets a precedent, meaning wallet devs might next face strict liability for user security.

São Paulo State Court Rules against Coinbase in $100K Trial

The state of São Paulo has ruled against Coinbase in a case that might set a precedent in the self-custody cryptocurrency wallet provider industry.

The São Paulo State Court ordered Coinbase to return nearly $100K to a user who deposited these funds into the Coinbase wallet, citing the Customer Protection Code provisions, which place the burden of proof for any claim on the business providing the service.

The customer claimed that the funds disappeared from their wallet without authorization. Coinbase alleged that it was not involved in this matter because the wallet’s private key was under the user’s full control.

Nonetheless, Coinbase failed to prove that the wallet holder did, in fact, initiate this transaction and was unable to demonstrate the existence of security measures to prevent this outcome.

Raphael Souza, a specialized cryptocurrency attorney, highlighted the relevance of this decision for self-custody wallet providers, which have a duty to build software resilient enough to withstand these attacks.

Souza told Portal do Bitcoin that this ruling dismantles two common arguments by crypto companies. “The first is that a self-custody portfolio does not generate liability. Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it.”

This applies to Coinbase, which is a registered company in Brazil, Souza assessed.

The other argument is that technical documents don’t aid in these cases by themselves if companies fail to provide a thorough explanation, aiding courts in understanding them. Magistrate Ju Hyeon Lee criticized Coinbase on this matter.

“Coinbase had every opportunity to prove that the investor authorized the transaction, explain the technical records, and inform where the funds went. It chose not to do any of that,” Souza concluded.

As the amount presented by the user was not contested, Coinbase was ordered to return the entire amount plus the due legal interest.