Coinbase Loses Self-Custody Defense in Brazilian Court Over Missing Crypto

Published by James Harris on July 12, 2026July 12, 2026

A Brazilian court has ordered Coinbase to repay approximately $100,000 to a customer after rejecting the company’s core legal defense for self-custody wallet products: that holding no private keys means holding no liability.

The São Paulo State Court found against Coinbase after a customer identified as Joubert moved funds into a Coinbase Wallet and later discovered the crypto had vanished without his authorization. Coinbase argued that because it does not control the private keys in its self-custody product, it has no power over what happens on-chain. Magistrate Ju Hyeon Lee applied Brazil’s Consumer Protection Code, which shifted the burden to Coinbase to demonstrate that Joubert had authorized the transfer. It could not. The court also found the company failed to show the wallet had basic protections like two-factor authentication, and criticized Coinbase for submitting technical records without making them legible to a non-specialist court.

What the Defense Was, and Why It Failed

The self-custody liability shield has been a standard argument across the industry. The logic is clean: if a company never touches the keys, it cannot be responsible for the door. Brazilian digital law attorney Raphael Souza said the ruling dismantles that position directly, stating that anyone who develops and puts a product on the market is responsible for its security, regardless of the technical architecture behind it. The second argument it collapses is equally practical: that companies can submit dense technical documentation and expect courts to parse it unaided.

Both of those positions have been reliable backstops for crypto firms in litigation. Losing them in a jurisdiction processing roughly $318 billion in crypto transactions between mid-2024 and mid-2025 is not a minor footnote.

Brazil’s Regulatory Direction Was Already Pointing Here

This ruling does not arrive in isolation from Brazil’s broader legal trajectory. The country’s Superior Court of Justice has already developed case law holding crypto platforms liable for fraud when they cannot demonstrate adequate security controls. More structurally, Brazil’s central bank reclassified virtual asset service providers as Type 3 institutions under Resolution 580/2026, placing them under the same regulatory framework as securities brokerages effective January 1, 2027. The São Paulo court’s reasoning fits that direction: treat crypto products as consumer financial products, apply consumer protection standards, and place the burden of proof on the provider.

The comparison that matters here is not to other Brazilian cases but to the post-FTX regulatory posture globally. Regulators and courts across multiple jurisdictions spent 2023 and 2024 closing the conceptual gap between “crypto platform” and “financial institution.” Brazil is now doing the same thing through its courts, one consumer dispute at a time.

Coinbase’s Broader Security Exposure Adds Pressure

The timing is uncomfortable for Coinbase specifically. The company disclosed a May 2025 breach in which bribed overseas support agents leaked customer data, with attackers demanding a $20 million ransom and threatening to publish records on roughly 70,000 customers. CEO Brian Armstrong redirected that $20 million toward a bounty rather than paying the ransom. On-chain investigator ZachXBT separately traced around $2 million in thefts to a single scammer impersonating Coinbase support, and Brooklyn prosecutors charged a 23-year-old with stealing $16 million from approximately 100 Coinbase users through impersonation calls tied to the same data leak.

That sequence matters because the São Paulo ruling’s logic, applied more broadly, would ask whether Coinbase’s security infrastructure was adequate at the product level. The company now faces a choice between appealing the decision and paying the assigned fees plus 10 percent court costs. An appeal would test whether the self-custody liability argument survives higher Brazilian courts. If it does not, wallet software makers operating in Brazil, not just exchanges, may need to rethink how they document security features and communicate with non-technical legal systems.