São Paulo court orders Coinbase to repay $100,000

A São Paulo state court ordered Coinbase to repay $100,000 after finding funds were taken from a user’s self‑custody wallet without authorization and concluding the company failed to prove the transfer was authorized.

The court applied provisions of Brazil’s Consumer Protection Code, which place the burden of proof for service-related claims on the business. The user had deposited the disputed funds into a Coinbase wallet and later reported the funds disappeared without consent. Coinbase argued it was not involved because the wallet’s private key remained under the user’s control, but the court found the company did not show the wallet holder initiated the transaction or explain technical records that would identify where the funds went.

Magistrate Ju Hyeon Lee criticized Coinbase’s handling of the case and wrote that the company “had every opportunity to prove that the investor authorized the transaction, explain the technical records, and inform where the funds went. It chose not to do any of that.” Because the amount claimed by the user was not contested, the court ordered Coinbase to return the full sum plus legal interest.

Coinbase is a registered company in Brazil, and the court treated it as the service provider responsible under consumer law. The judgment says firms that create or distribute wallet software must be able to explain security measures and transaction records in detail when a customer claims an unauthorized transfer.

Raphael Souza, a lawyer who specializes in cryptocurrency, said the ruling challenges common defenses used by crypto firms. He said: “The first is that a self‑custody portfolio does not generate liability. Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it.” Souza added that providing technical documents without a clear explanation will not satisfy a court.

The decision records that Coinbase did not demonstrate authorization or adequate protections in this case. The ruling notes the company did not show how transactions were authorized or provide clear logs that traced the missing funds.