Brazilian court rejects Coinbase’s self-custody defence, orders $100,000 repayment
A São Paulo ruling applying consumer protection law to a wallet theft could reshape how exchanges answer for losses beyond their custody.
A state court in São Paulo has ordered Coinbase to repay approximately $100,000 to a customer whose cryptocurrency vanished from a Coinbase Wallet, in a ruling that rejects the exchange’s argument that self-custody absolves it of responsibility when user funds are stolen.
The court applied Brazil’s Consumer Protection Code, finding that Coinbase had failed to demonstrate that the disputed transfer was authorised by the user or that adequate security safeguards had been in place. The ruling requires the company to reimburse roughly R$500,000, the equivalent of the reported $100,000 sum, according to the Brazilian legal outlet Estrato, which first reported details of the judgment.
A challenge to the self-custody defence
At the heart of the case is a question that has troubled regulators and litigants across multiple jurisdictions: whether an exchange or wallet provider can disclaim liability once a customer’s assets are moved into a non-custodial wallet nominally beyond the firm’s direct control. Coinbase had argued that self-custody wallets place responsibility for asset security squarely with the user, not the platform that supplies the software.
The São Paulo court did not accept that framing. Instead, it treated Coinbase as a consumer-facing service provider bound by ordinary Brazilian consumer protection obligations, meaning the burden fell on the company to show either that the user had authorised the disputed transaction or that reasonable security measures existed to prevent unauthorised access. Coinbase, the court found, could do neither.
Why the ruling matters beyond Brazil
Legal observers cited by both Brazilian and international outlets suggest the decision could set a domestic precedent extending liability for wallet security failures to software developers and platform operators, not merely to the individuals whose keys were compromised. Brazil is among the largest crypto markets globally, and its courts have increasingly been asked to apply existing consumer law to novel digital asset disputes rather than waiting for bespoke crypto legislation.
For European readers, the case lands at a moment when regulators on the continent are still working through the practical implications of the Markets in Crypto-Assets Regulation, which imposes its own custody and consumer safeguarding obligations on crypto-asset service providers operating in the EU. Brazilian courts applying consumer protection frameworks to self-custody products offers an early test case of how far liability might extend when platforms market wallet software as a consumer product, even where the underlying assets are technically outside the firm’s custodial control.
The judgment does not appear to have been appealed as yet, and Coinbase has not issued a public statement addressed directly to the ruling in the reporting reviewed. The size of the award, at roughly $100,000, is modest by the standards of large-scale exchange litigation, but the reasoning behind it is what has drawn attention from lawyers tracking how consumer protection statutes are being retrofitted onto crypto custody disputes.
Read more: Circle wins full US federal bank charter, folding $73bn stablecoin into OCC oversight
