A São Paulo state court has ordered cryptocurrency exchange Coinbase to refund nearly $100,000 that a user alleged was deposited into their wallet but later went missing.

 

According to the complainant, about 507,000 reais, or nearly $100,000, deposited into their Coinbase wallet disappeared without authorization. However, Coinbase claimed it had nothing to do with the missing funds, arguing that the user’s private key was fully under the user’s control.

 

Although Coinbase contended that it had no access to users’ wallet private keys and could not control blockchain transactions, it failed to prove that the compromised wallet was equipped with essential security features, such as two-factor authentication. As a result, Coinbase was unable to prove that the complainant had authorized the transactions.

 

The court, presided over by Judge Ju Hyeon Lee, ruled that Coinbase must reimburse the full amount of the missing funds in accordance with Brazil’s Customer Protection Code. The exchange was also ordered to cover court costs, which amounted to 10% of the claim, as well as any applicable legal fees.

 

Responding to the court ruling, Raphael Souza, a cryptocurrency-specialized lawyer, spoke to Portal do Bitcoin, one of Brazil’s leading cryptocurrency news platforms, highlighting the significance of the decision and its potential impact on crypto companies operating in Brazil.

 

Souza said the ruling dismantled two common arguments used by crypto companies. “The first is that a self-custody portfolio does not generate liability. Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it.” According to Souza, this applies to Coinbase because it is a registered entity in Brazil.

 

The second argument Souza said the ruling challenged is that technical documents alone are insufficient in cases like this if companies fail to provide a thorough, understandable explanation.

 

“Coinbase had every opportunity to prove that the investor authorized the transaction, explain the technical records, and inform where the funds went. It chose not to do any of that,” Souza asserted.

 

While Coinbase has not suffered any major security breach in recent times that resulted in the loss of customer funds, some of the company’s rogue overseas employees were allegedly bribed by attackers to gain access to its internal support systems.

 

The unauthorized access allowed the attackers to obtain customers’ sensitive data, including names, contact information, and account details. Although the attackers demanded a $20 million ransom, which Coinbase refused to pay, the company said the incident cost it between $180 million and $400 million, largely due to remediation efforts and customer reimbursements.