A court in São Paulo, Brazil, has ordered Coinbase to repay over 507,000 reais (roughly $100,000) to an investor identified as Joubert. The investor transferred digital assets from other exchanges into his Coinbase Wallet, only to find them missing without his authorization.
Court Prioritizes Consumer Protection Code
Coinbase argued it had no access to the wallet's private keys and no control over blockchain transactions. However, Judge Ju Hyeon Lee ruled that Brazil's Consumer Protection Code required Coinbase to prove Joubert had authorized the disputed transfer. The company failed to produce such evidence. The court also noted that Coinbase did not demonstrate the wallet had essential security features, such as blocking mechanisms or two-factor authentication. Judge Lee criticized Coinbase for submitting technical documents that were difficult for the court to interpret and not presented in plain language.
Under the ruling, Coinbase must return the full amount, pay court costs equal to 10% of the claim, and potentially cover legal fees.
Legal Precedent for Self-Custody Products
Digital law attorney Raphael Souza said the decision challenges the common defense used by crypto platforms—disclaimers of responsibility for self-custody products. He emphasized that manufacturers and providers are liable for user security regardless of underlying technology. Companies cannot overwhelm courts with complex documentation and expect judges to determine liability on their own.
Legal experts believe this ruling could set a benchmark for how Brazilian courts handle self-custody crypto disputes in the future.
Brazil Tightens Crypto Oversight
Brazil's central bank has reclassified virtual asset service providers as Type 3 institutions under Resolution 580/2026, effective January 1, 2027. This puts crypto platforms under the same regulatory requirements as securities brokerages. From mid-2024 to mid-2025, Brazil processed approximately $318 billion in crypto transactions. Consumer protection is becoming a higher priority as regulation tightens.
Coinbase Grapples with Security Incidents
Beyond this ruling, Coinbase has faced multiple security failures. In December 2025, on-chain investigator ZachXBT traced about $2 million in stolen funds to a scammer impersonating Coinbase support. In a separate case, a 23-year-old was charged with stealing $16 million from roughly 100 Coinbase users through fraudulent phone calls.
Many of those scams traced back to a May 2025 data breach, when corrupt overseas support agents leaked customer information. Attackers demanded a $20 million ransom and threatened to release sensitive data of nearly 70,000 Coinbase users. CEO Brian Armstrong later said the company did not pay the ransom but instead allocated that $20 million to a bounty program to track down the attackers.
Coinbase may now appeal the São Paulo court decision or comply with the financial penalties.