Sao Paulo Court Orders Coinbase to Repay $100K, Rejects Wallet Defense

A Sao Paulo court has ordered Coinbase to repay roughly $100,000 to a customer whose crypto vanished from a self-custody wallet. The court rejected the company’s argument that it owed nothing once the user held the keys.

Brazil’s Sao Paulo State Court, known as the TJSP, found Coinbase could not prove the transfer was authorized or that basic protections, like two-factor login, ever existed on the account. The case tests an assumption built into every self-custody wallet sold by Coinbase, MetaMask, Trust Wallet and dozens of other providers, that handing over the keys also hands over all the risk. A Brazilian magistrate just rejected that assumption on the facts in front of her, and lawyers tracking the case say more courts could follow.

A Sao Paulo Judge Rejects the No-Liability Defense

Brazilian courts may start holding wallet software makers responsible for user security after the TJSP told Nasdaq-listed Coinbase (NASDAQ: COIN) to repay about 507,000 reais, roughly $100,000, to an investor identified in court filings only as Joubert.

Joubert had moved crypto from other exchanges into his Coinbase Wallet. The funds later vanished, with no authorization from him on record.

Coinbase’s defense rested on one point: the company said it never held the private keys to Joubert’s wallet and had no power over transactions once they hit the blockchain. Magistrate Ju Hyeon Lee, who heard the case, did not accept that. Applying Brazil’s consumer protection statute, she ruled the burden of proof sat with Coinbase, and the company could not show Joubert authorized the transfer or that the wallet carried basic safeguards like blocking tools and two-factor authentication.

The judge also faulted Coinbase for a more mundane failure, dumping complex technical records into the case file without translating them into language the court could use. Coinbase was ordered to repay the full amount plus legal interest, and to cover court costs equal to 10% of the claim.

How Brazil’s Consumer Code Flipped the Burden of Proof

Brazil’s consumer protection statute, the Codigo de Defesa do Consumidor (CDC), treats digital platforms as suppliers with duties toward their users, and it has already been applied to other tech and finance services in earlier disputes. The Sao Paulo court found Coinbase’s relationship with Joubert counted as a consumer service relationship no matter where his assets ended up.

That detail matters because Coinbase had argued the reverse, that once assets moved to external, self-hosted custody, its obligations ended too. The court disagreed, ruling that moving assets to a wallet outside Coinbase’s control did not erase the company’s duties as the business that built and distributed the software.

Raphael Souza, a Brazilian attorney who specializes in digital and cryptocurrency law, said the ruling dismantles two defenses crypto platforms lean on constantly in court.

Anyone who develops and puts a product on the market is responsible for its security, regardless of how the technical architecture works behind it.

Souza made that argument to a Brazilian legal outlet, saying it applies squarely to Coinbase since the company is registered and operating inside the country. He added that handing a court a stack of technical documents without a plain explanation will not satisfy a Brazilian judge either.

The ruling also lands as Brazil tightens oversight of virtual asset service providers, or VASPs, more broadly. Central bank rules under BCB Resolution 521 set transaction limits of $100,000 for standalone VASPs and a higher cap for licensed financial institutions handling virtual assets, part of a wider push to fold crypto firms into the country’s foreign exchange rulebook.

What the Ruling Undermines for Wallet Makers

Souza’s comments point to three assumptions the industry has leaned on for years. This ruling chips away at all three.

• Self-custody as a liability shield – the idea that a wallet maker owes nothing once a user controls the keys, an argument Judge Lee rejected outright when she found Coinbase still had to prove the transfer was authorized.
• The document-dump defense – submitting dense technical records and expecting a court to sort through them without a clear, plain-language explanation.
• A consumer-side burden of proof – under the CDC, it is the company, not the customer, that must show a transaction was authorized and that safeguards were in place.

The same pattern shows up outside Brazil too. Coinbase’s own U.S. user agreement disclaims any obligation to act in a customer’s interests, even as the company holds more than $400 billion in assets under custody and serves millions of monthly users worldwide. The gap between how Coinbase’s contracts read and how a Brazilian court just ruled is exactly what has attorneys paying attention.

Brazil’s Crypto Market Is Too Big to Write Off

Brazil ranks as the largest cryptoasset market in Latin America, having received an estimated $318.8 billion in crypto value between mid-2024 and mid-2025, a 109.9% jump from the prior period that put it fifth globally on one adoption index.

Growth has not slowed. Transaction volume across Brazil’s crypto market climbed 43% year over year in 2025, with average investment per user crossing $1,000 for the first time, according to exchange Mercado Bitcoin.

That scale is why Coinbase and its rivals keep pushing into the region even as legal friction piles up. Coinbase has made a similar emerging-market bet in India, building direct rupee settlement rails despite a domestic tax regime that discourages local trading. Markets this large are difficult for a listed exchange to abandon over one courtroom loss.

Coinbase’s Longer Record of Security Trouble

The Joubert case is not Coinbase’s only recent brush with wallet security failures. In December 2025, on-chain investigator ZachXBT traced roughly $2 million in thefts to a single scammer posing as Coinbase support staff. Separately, Brooklyn prosecutors charged a 23-year-old man with stealing $16 million from about 100 Coinbase users through impersonation calls.

Many of those scams trace back to a May 2025 breach in which bribed overseas support agents leaked customer data. Attackers demanded a $20 million ransom and threatened to publish records tied to nearly 70,000 customers. Coinbase said at the time that no passwords, private keys or funds were exposed, and that fewer than 1% of its monthly transacting users had personal data pulled by the attackers.

The company refused to pay and instead set up a $20 million reward fund for information on the hackers, a decision that has not stopped a wave of related litigation and arbitration claims in the United States.

The pattern is bigger than one exchange, too. Coinbase is also named as a defendant, alongside Kalshi and Robinhood, in a Kentucky lawsuit over prediction markets, a separate legal front with no connection to wallet security but one more sign the company is fighting battles on several fronts at once.

Does One Sao Paulo Case Set a Precedent for All of Brazil?

Not automatically. A single state court ruling does not bind other Brazilian courts or higher tribunals, and Coinbase has not exhausted its appeals. But attorneys tracking the case say its reasoning, if it survives review, could travel well beyond one city’s docket.

• A legal analysis from TFTC argues that because the CDC is a legislative model used across Latin America, a surviving ruling could become persuasive authority in other countries with similar consumer protection statutes, at a time when Bitcoin adoption across the region keeps climbing.
• Crypto outlet Coincu counters that a single state-level ruling does not automatically bind other jurisdictions or even Brazil’s own higher courts, and that the decision could still be reversed on appeal.

The theory has a built-in test. If an appellate court finds self-custody software legally distinct from custodial services, or reads the ruling narrowly as specific to Coinbase’s evidence failures rather than a rule for every wallet maker, the precedent risk fades. Brazil’s Superior Court of Justice has already shown some appetite for holding platforms responsible for fraud when they cannot prove adequate security, which is part of why lawyers see this case as more than a one-off.

Coinbase can appeal the Sao Paulo ruling, or pay the $100,000 award and the 10% in court costs that come with it.

Disclaimer: This article is for informational purposes only and does not constitute legal or investment advice. Cryptocurrency markets and court rulings carry risk, and the decision described here may still be appealed or overturned. Consult a qualified professional before making financial or legal decisions. Figures are accurate as of publication.